R1.05 re-check: installation-security, data-access, equipment

Read-only re-check on the shared R1.05 test server plus a diff of the R1.03 and R1.05 manual editions. - installation-security: R1.05 OS list, Defender exceptions, IT security 2.0/3.0, LAPS, automatic configuration merge (jupgutl), PRM chapter, port 34597; setup_check.ps1 gets -Version (default 1.05.00). - data-access: L45 renumbered (new ch. 4 RESTful API), extended OPC UA functions off by default, OPC UA methods (OPCUAC_METHOD_CALL2_DF), Information Model Mapper, ServerConfig.xml in %TLS_SAV_PATH%. - equipment: Modbus unchanged; IEC 104/61850 run as EQT managers (eqtdbg, eqtfrcscn), IEC 61850 report control blocks, upgrade steps. - Issues ISS-076..090; R1.05 notes on ISS-003/008/032/034/061; progress and version-differences updated. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-08 18:26:35 +11:00 · 2026-10-08 18:26:35 +11:00 · b85a65250c
commit b85a65250c
parent 0a910e1b50
20 changed files with 975 additions and 329 deletions
--- a/.claude/skills/data-access/SKILL.md
+++ b/.claude/skills/data-access/SKILL.md
@ -1,24 +1,27 @@
 ---
 name: data-access
 description: >-
-  CI Server R1.03 ACCESS Service: OPC UA, OPC DA, OPC A&E and ODBC. Use when the user wants to
+  CI Server R1.05 ACCESS Service: OPC UA, OPC DA, OPC A&E, ODBC and the RESTful API. Use when
-  connect CI Server to an OPC UA server (OPC UA client line, station, subscription, points,
+  the user wants to connect CI Server to an OPC UA server (OPC UA client line, station,
-  certificates, node IDs, browse), let another application read CI Server data over OPC UA, OPC
+  subscription, points, certificates, node IDs, browse, OPC UA methods MTD_KEY / MTD_TRG,
-  DA or OPC A&E (CI Server as OPC server, OPC visible / read / write, port 34493, endpoints,
+  OPCUAC_METHOD_CALL2_DF), let another application read CI Server data over OPC UA, OPC DA or
-  security policy, trusting client certificates, UaExpert), check why an OPC connection fails
+  OPC A&E (CI Server as OPC server, OPC visible / read / write, port 34493, endpoints, security
-  (BadCertificateUntrusted, BadSecurityChecksFailed, item stays NOT INIT), configure DCOM or DCOM
+  policy, trusting client certificates, UaExpert, extended OPC UA functions for alarms, history
-  tunnelling for OPC Classic, use ODBC / SimbaClient / SQL on datasets, or check the ODBC server
+  and PubSub, OPC UA Information Model Mapper, NodeSet / imported information model), check why
-  (odbsrv, port 1583, SSL certificate), or copy item values and timestamps into Microsoft SQL
+  an OPC connection fails (BadCertificateUntrusted, BadSecurityChecksFailed, item stays NOT INIT,
-  Server with RDBMS data exposure (dbc.sup, DEM_CONNECTION, DBCSND, DBCDEM, DATA_EXPOSURE_DF,
+  certificate expiry warning), configure DCOM or DCOM tunnelling for OPC Classic, use ODBC /
-  data exposure aggregation interval AGG_INTERVAL, ITEM_VALUES, SQL login, DSS-E-FLT_SYN_ERR).
+  SimbaClient / SQL on datasets, or check the ODBC server (odbsrv, port 1583, SSL certificate),
-  Sources IM 36K10L45-01EN, IM 36K10E20-01EN, IM 36K10G10-01EN ch. 10.
+  use the RESTful API (jrstsrv, port 34597, API key, x-api-key), or copy item values and
  timestamps into Microsoft SQL Server with RDBMS data exposure (dbc.sup, DEM_CONNECTION, DBCSND,
  DBCDEM, DATA_EXPOSURE_DF, data exposure aggregation interval AGG_INTERVAL, ITEM_VALUES, SQL
  login, DSS-E-FLT_SYN_ERR). Sources IM 36K10L45-01EN, IM 36K10E20-01EN, IM 36K10G10-01EN ch. 10.
 ---
-# Data access: OPC, ODBC and RDBMS data exposure (R1.03; RDBMS exposure tested in R1.05 only)
+# Data access: OPC, ODBC, RESTful API and RDBMS data exposure (R1.05; first written for R1.03)
-Background: `knowledge/manuals/IM36K10L45-01EN.md` (ODBC, OPC DA/A&E/UA client and server,
+Background: `knowledge/manuals/IM36K10L45-01EN.md` (ODBC, RESTful API, OPC DA/A&E/UA client and
-setup files), `IM36K10E20-01EN.md` (Engineering Module forms, certificates, PubSub). Equipment
+server, setup files), `IM36K10E20-01EN.md` (Engineering Module forms, certificates, Information
-lines/stations/points in general: skill `equipment`.
+Model Mapper, PubSub). Equipment lines/stations/points in general: skill `equipment`.
 Rules:
 - Run `system-check` first; follow the user's chosen way of working.
@ -26,20 +29,30 @@ Rules:
  common name) and let the user trust it (Engineering Module or moving the file); do not move
  certificate files yourself.
 - Making items OPC visible / writable exposes them to every OPC client on the network: only
-  with the user's approval, and prefer read-only.
+  with the user's approval, and prefer read-only. The same applies to the RESTful API (keep its
  read-only mode, the product default, unless the user decides otherwise).
 - Never connect a CI Server OPC **DA or A&E** client to the same node's (or a DURM-connected
-  node's) DA/A&E server: deadlock (manual §5.3). The OPC **UA** loopback is fine.
+  node's) DA/A&E server: deadlock (IM 36K10L45 5th ed. §6.3). The OPC **UA** loopback is fine.
- Changing `opxsys.sup`, `opxuas.sup`, `odbsrv.sup` or `ServerConfig.xml` needs admin rights and
+- **Extended OPC UA functions are off by default since R1.04.** The OPC UA server offers only
-  a restart: hand it to the user (skill `portal-setup`, task `change-setup-file.md`).
+  Data Access and methods unless `OPXUAS_ENABLE_EXTENDED_FUNC = YES` in `opxuas.sup` (needed for
  Alarms & Conditions, HistoryRead and PubSub); the OPC UA client receives no alarms unless
  `OPXC_ENABLE_EXTENDED_FUNC = YES` in its `<process>.sup`. Both are `NO` on the R1.05 test
  server (verified 2026-10-08). Source: IM 36K10L45 5th ed. ch. 11 intro, §10.4, §10.11,
  §11.6.2, App. 1.3.
 - Changing `opxsys.sup`, `opxuas.sup`, `<process>.sup`, `odbsrv.sup`, `jrstsrv.sup` or
  `ServerConfig.xml` needs admin rights and a restart: hand it to the user (skill
  `portal-setup`, task `change-setup-file.md`).
 - The same applies to `dbc.sup` (RDBMS data exposure). SQL Server changes (mixed mode, logins,
  jobs) are on another system: only with the user's and the SQL Server owner's agreement.
 | Task | File | Status |
 |---|---|---|
-| OPC UA client to an OPC UA server (sample: loopback to CI Server's own server): line, station, subscription, points, certificate exchange, node IDs, browse via dataset | `tasks/opcua-client.md` | verified |
+| OPC UA client to an OPC UA server (sample: loopback to CI Server's own server): line, station, subscription, points, certificate exchange, node IDs, browse via dataset | `tasks/opcua-client.md` | verified on R1.03; R1.05 files and datasets checked, loopback not re-run |
-| Make CI Server data available to OPC clients (OPC visible / Read / Write); CI Server OPC UA server endpoints, node IDs, certificates | `tasks/opcua-client.md` §1, §5 | verified (UA); DA/A&E from docs |
+| Make CI Server data available to OPC clients (OPC visible / Read / Write); CI Server OPC UA server endpoints, node IDs, certificates | `tasks/opcua-client.md` §1, §5 | verified on R1.03 (UA); DA/A&E from docs |
-| Read-only checks: ACCESS processes, ports, OPC UA server config and PKI, ODBC server state | `tasks/access-checks.md` | verified |
+| Read-only checks: ACCESS processes, ports (34493, 1583, 34597), OPC UA server config and PKI, extended functions, certificate validity, ODBC server state | `tasks/access-checks.md` | verified on R1.05 (2026-10-08) |
 | OPC UA client methods (`MTD_*` object, method form, `CIX_UAC_MTD` point) and R1.03 → R1.04 method upgrade | `tasks/opcua-client.md` §7 | from docs |
 | OPC DA / A&E client and server, DCOM, DCOM tunnelling | L45 summary §3–§5 | from docs (DA loopback not allowed) |
-| ODBC with SimbaClient | L45 summary §1 | from docs; ODBC server not running on the test system (ISS-008) |
+| ODBC with SimbaClient | L45 summary §1 | from docs; ODBC server not running on the R1.03 and R1.05 test systems (ISS-008) |
-| OPC UA alarms (external alarms), methods, PubSub | L45 §6, E20 §2–§4 | from docs |
+| RESTful API (`jrstsrv`, port 34597, API key, functions) | L45 summary §9 | from docs; port and setup keywords verified on R1.05 |
 | OPC UA alarms (external alarms), model change events, PubSub, imported information model / Information Model Mapper | L45 summary §6–§7, E20 summary §2–§5 | from docs |
 | RDBMS data exposure to SQL Server: SQL login, `dbc.sup` `DEM_CONNECTION`, `DATA_EXPOSURE_DF` (filter syntax), item aggregation interval, checks, table behaviour, SQL-side retention | `tasks/rdbms-exposure.md` | tested in R1.05 only (`ITEM_VALUES`); `ITEM_HISTORY` / `ITEM_INPUTS` not tested |
--- a/.claude/skills/data-access/tasks/access-checks.md
+++ b/.claude/skills/data-access/tasks/access-checks.md
@ -1,23 +1,26 @@
 ---
-task: Read-only checks of ACCESS Service (OPC UA server, OPC clients, ODBC server)
+task: Read-only checks of ACCESS Service (OPC UA server, OPC clients, ODBC server, RESTful API)
-version: R1.03
+version: R1.05 (first written for R1.03)
-source: IM 36K10L45-01EN §1–§3, §6, §9, §10; practiced on the test system 2026-10-01
+source: IM 36K10L45-01EN 5th ed. (Feb. 2026) §1–§3, §4.2, §7, §10, §11; IM 36K10E20-01EN 4th ed. §2.2; practiced on the R1.03 test system 2026-10-01; re-checked read-only on the R1.05 test server 2026-10-08
-status: verified
+status: verified on R1.05 (2026-10-08, read-only checks below); R1.03 results kept where marked
 ---
 # ACCESS Service checks (read-only)
-| Check | How | Test system result |
+| Check | How | Result (R1.05 test server 2026-10-08 unless marked) |
 |---|---|---|
-| Processes | `tasklist` → `opxuas.exe` (UA server), `opxuac.exe` (one per OPC UA line + `opxuac_mon`), `opxdas12.exe` / `opxaes.exe` (only while a client is connected), `opxdac.exe`/`opxaec.exe` (per line); `durwfp -p <name> -t 0` → 0 = attached | `opxuas`, `opxuac` (`OPXUAC_MON`) running |
+| Processes | `tasklist` → `opxuas.exe` (UA server), `opxuac.exe` (one per OPC UA line + `opxuac_mon`), `opxdas12.exe` / `opxaes.exe` (only while a client is connected), `opxdac.exe`/`opxaec.exe` (per line), a `javaw.exe` for the RESTful API server; `durwfp -p <name> -t 0` → 0 = attached | `opxuas`, `opxuac` (`OPXUAC_MON`) running; no `odbsrv` (same on R1.03) |
-| Ports | `netstat -ano` LISTENING: 34493 (OPC UA server), 1583 (ODBC), 135 (DCOM) | 34493 yes, 1583 **no** |
+| Ports | `netstat -ano` LISTENING: 34493 (OPC UA server), 1583 (ODBC), 34597 (RESTful API, R1.04+), 135 (DCOM) | 34493 yes, 34597 yes, 135 yes, 1583 **no** (R1.03: same, no 34597) |
-| Start log | `%TLS_LOG_PATH%\ci_start.log`, `umhlog.log` | `InitializeSslCtx(): SSL_CTX_use_certificate_chain_file() failed` + `Process ODBSRV exited unexpectedly` = ODBC server cannot load its certificate (ISS-008) |
+| Start log | `%TLS_LOG_PATH%\ci_start.log`, `umhlog.log` | `InitializeSslCtx(): SSL_CTX_use_certificate_chain_file() failed` + `Process ODBSRV exited unexpectedly` = ODBC server cannot load its certificate (ISS-008; R1.03 and R1.05) |
-| ODBC settings | `tls\sup\odbsrv.sup` (`PORT`, `USESSL`), certificate `%TLS_ROOT_PATH%\tls\pki\odbsrv\SampleServerCertificate.pem` + key | `USESSL YES`, folder missing |
+| ODBC settings | `tls\sup\odbsrv.sup` (`PORT`, `USESSL`), certificate `%TLS_ROOT_PATH%\tls\pki\odbsrv\SampleServerCertificate.pem` + key | `odbsrv.sup` identical to R1.03, `USESSL YES`, folder missing |
-| OPC UA server settings | `tls\sup\opxuas.sup`; endpoints and user tokens in `tls\exe\ServerConfig.xml` (ignore commented XML) | Endpoint `opc.tcp://[NodeName]:34493`; Basic256Sha256 / Aes128_Sha256_RsaOaep / Aes256_Sha256_RsaPss with Sign or SignAndEncrypt; anonymous, user/password, certificate tokens on |
+| OPC UA server settings | `tls\sup\opxuas.sup`; endpoints and user tokens in `ServerConfig.xml` — R1.05: `%TLS_SAV_PATH%\ServerConfig.xml` (R1.03: `%TLS_ROOT_PATH%\tls\exe`; ISS-081); ignore commented XML | Endpoint `opc.tcp://[NodeName]:34493`; Basic256Sha256 / Aes128_Sha256_RsaOaep / Aes256_Sha256_RsaPss with Sign or SignAndEncrypt; anonymous, user/password, certificate tokens on (unchanged from R1.03; the R1.05 file only adds SDK sections) |
-| OPC UA certificates | `%TLS_ALLUSERS_PATH%\pki\opxuas\pkiserver\{own,trusted,rejected,issuers}`; client `…\pki\opxuac\pkiclient\{own,trusted,rejected,deleted,issuers}`; dataset `OPCUAC_PKI_CERTIFICATES_DF` | Server own `ciserveruaserver.der` |
+| Extended OPC UA functions | `findstr EXTENDED_FUNC` in `opxuas.sup` and in the client's `<process>.sup` (template `epauac_eqp.sup`) | `OPXUAS_ENABLE_EXTENDED_FUNC = NO`, `OPXC_ENABLE_EXTENDED_FUNC = NO` (product defaults): no OPC UA alarms, HistoryRead or PubSub until set to YES |
-| OPC Classic settings | `tls\sup\opxsys.sup` (tabs Alarm and Event Client, Data Access Server, Alarm & Event Server) | Defaults; `OPXAEC_SAFE_CON NO` |
+| OPC UA certificates | `%TLS_ALLUSERS_PATH%\pki\opxuas\pkiserver\{own,trusted,rejected,issuers}`; client `…\pki\opxuac\pkiclient\{own,trusted,rejected,deleted,issuers}`; dataset `OPCUAC_PKI_CERTIFICATES_DF` | Server own `ciserveruaserver.der`; client own `<host>_OPXUAC_MON.der`; server `rejected` absent until the first rejection |
-| OPC UA client config | export `OPCUAC_LINE_DF`, `…_STATION_DF`, `…_SUBSCRIPTION_DF`, `…_POINT_DF` | Only the sample loopback |
+| Certificate validity | `certutil -dump <file>.der` and look at `NotAfter` | Both own certificates valid 5 years from installation. The OPC UA client warns in the Historical Alarm Overview and the UMH message log before a client or server certificate expires (IM 36K10E20 4th ed. §2.2); lead time = hidden keyword `OPXC_CERT_EXP_PERIOD_WARN`, 2 months in `epauac_eqp.sup` |
-| Logs | `%TLS_LOG_PATH%\OPXUAS.log`, `OpxUas_Sdk*.log`, `<UA client process>.log` | |
+| OPC Classic settings | `tls\sup\opxsys.sup` (tabs Alarm and Event Client, Data Access Server, Alarm & Event Server) | Defaults; `OPXAEC_SAFE_CON NO`; new in R1.05: `OPXAES_DIR_ALM = YES` (A&E server, "Direct" alarm events; not in the manual, ISS-085) |
 | OPC UA client config | export `OPCUAC_LINE_DF`, `…_STATION_DF`, `…_SUBSCRIPTION_DF`, `…_POINT_DF`, `OPCUAC_METHOD_CALL2_DF` | R1.03: only the sample loopback. R1.05: dataset structure of line, station, subscription and point unchanged |
 | RESTful API settings | `tls\sup\jrstsrv.sup`: `JRST_NETWORK_PORT` (34597), `JRST_READ_ONLY_MODE` (product default YES), `JRST_MAX_RECORDS` (default 100), `JRST_USE_TWO_WAY_SSL` (NO), `JRST_USER_CACHE_TIME` (600 s), `JRST_CUSTOM_DATASETS`; API keys in dataset `API_KEYS_DF` (export without records in reports) | Keywords as in IM 36K10L45 5th ed. §4.2.1; compare the active values with the `!DEFAULT` block |
 | Logs | `%TLS_LOG_PATH%\OPXUAS.log`, `OpxUas_Sdk*.log`, `<UA client process>.log` | `OPXUAS.log`, `OpxUas_Sdk*.log`, `OPXUAC_MON.log` present |
 Fixing the ODBC server (only if ODBC is licensed and wanted; admin): place a certificate and key
 with the names above in `%TLS_ROOT_PATH%\tls\pki\odbsrv\`, or set `USESSL = NO` in `odbsrv.sup`
--- a/.claude/skills/data-access/tasks/opcua-client.md
+++ b/.claude/skills/data-access/tasks/opcua-client.md
@ -1,8 +1,8 @@
 ---
 task: OPC UA client to an OPC UA server by quick load (loopback to CI Server's own OPC UA server)
-version: R1.03
+version: R1.05 (first written for R1.03)
-source: IM 36K10L45-01EN §9, §10; IM 36K10E20-01EN §2; practiced on CI-Eng-Sample 2026-10-01 (station CIENG_UA; full remove/reload; point also configured in the Engineering Module by the user and compared)
+source: IM 36K10L45-01EN 5th ed. (Feb. 2026) §10, §11; IM 36K10E20-01EN 4th ed. (Feb. 2026) §2; practiced on CI-Eng-Sample 2026-10-01 on R1.03 (station CIENG_UA; full remove/reload; point also configured in the Engineering Module by the user and compared)
-status: verified
+status: verified on R1.03 (§1–§6). R1.05 (2026-10-08, read-only): line/station/subscription/point dataset definitions identical to R1.03, PKI folders and client setup files checked; the loopback itself was not re-run on the shared R1.05 test server. §7 (methods) from docs.
 ---
 # OPC UA client to an OPC UA server
@ -45,13 +45,25 @@ These flags also apply to the OPC DA and A&E servers.
   ```
   "CIENG_UA_LINE","CI-Eng-Sample OPC UA loopback line","OPXCIENG"
   ```
   The process reads `tls\sup\<process>.sup` (here `opxcieng.sup`), else the template
   `epauac_eqp.sup` (IM 36K10L45 5th ed. §10.11; the R1.03 manual named a non-existent
   `opxuac.sup`, ISS-084). On the R1.03 test system `opxcieng.sup` appeared as an exact copy of
   the template. R1.05 template changes (verified 2026-10-08, ISS-083): new
   `OPXC_ENABLE_EXTENDED_FUNC` (NO; YES needed for OPC UA alarms), `OPXC_BASE_MODEL_CHANGE_EVENT`
   (NO), `OPXC_DISABLE_SAV_FILE` (NO), `OPXC_ALARM_TIME_ATTRIBUTE`, hidden
   `OPXC_CERT_EXP_PERIOD_WARN` (2 months), and `OPXC_SERVICE_CALL_TIME_OUT` 60 s (manual: 10 s).
   A per-process file copied from R1.03 lacks these keywords, so their defaults apply.
 2. **Station** (`OPCUAC_STATION_DF`), **subscription** (`OPCUAC_SUBSCRIPTION_DF`, name
   `<station>:<subscription>`), **points** (`OPCUAC_POINT_DF`, name `<station>:<point>`) —
   see `14_opcua_station_df.qli`:
   - Station: `LINE`, `USER_ANONYMOUS` 1 (or `USER_NAME`/`USER_PASSWORD`),
     `MSG_SECURITY_01_MODE` `SignAndEncrypt`, `MSG_SECURITY_01_POLICY` `Basic256Sha256`,
-     `SERVER_01_ENDPOINT` `opc.tcp://localhost:34493`, `STATUS_ITEM` (Boolean item, 1 =
+     `SERVER_01_ENDPOINT` `opc.tcp://localhost:34493`, `STATUS_ITEM` (1 = connected; a Boolean
-     connected). `SERVER_01_NAME`/`_URI` may stay empty.
+     item worked on R1.03). `SERVER_01_NAME`/`_URI` may stay empty. The R1.05 OPC Interface
     manual (IM 36K10E20 4th ed. §2.1.2) lists states 0–5 for this item (0 preparing,
     1 connected, 2 comm error/reconnecting, 3 connect failed, 4 server shutdown received,
     5 connection recreated) while IM 36K10L45 §10.9.2 still calls it Boolean; not re-tested on
     R1.05 (ISS-080). An Integer item shows all states.
   - Subscription: `REQUESTED_PUBLISH_INTERVAL` 1000.
   - Point: `SUBSCRIPTION`, `EXTERNAL_RELATION` (`Input`, `Output`, `Input + Output`),
     `OPC_NAMESPACE` (namespace **URI**, not index), `OPC_NODE_ID_TYPE` (`STRING`, `NUMERIC`,
@ -94,7 +106,26 @@ a filter; start with an empty path, then `Objects`:
 ```
 Each record shows display name, namespace URI and node ID (inside `OPC_TAG_INFO`). Deeper
-paths were not found yet (`Objects.CI-Eng-Sample` returned nothing).
+paths were not found yet on R1.03 (`Objects.CI-Eng-Sample` returned nothing).
 R1.05: `OPCUAC_TAG_DF` (and `OPCUAC_TAG_CMPN_DF`) have two new Boolean fields, `REBROWSE`
 (ask the server again) and `READ_NODE_INFO` (read node attributes while browsing; switching it
 off is faster on slow links) (installed `opcuac_tag_df.dss`, verified 2026-10-08; not tried).
 The point form has the matching *Read additional node information* check box, and F5 in the
 expanded *Browse path* list rebrowses (IM 36K10E20 4th ed. §2.1.5).
 **Data types (IM 36K10L45 5th ed. §10.3.4, from docs):** UInt32, Int64 and UInt64 map to Real
 (no negatives for unsigned, no decimals), DateTime/UtcTime to String in the form
 `YYYY-MM-DDThh:mm:ss.sssZ`, ExtensionObject only for EURange / EngineeringUnits, enumerations as
 their Int32 value; one array element per point. A value that cannot be converted is logged and
 the item gets status Bad.
 **Model change events (IM 36K10L45 5th ed. §10.5, from docs):** the client reacts to the
 server's `GeneralModelChangeEvent` (node or reference added: the point is recreated; deleted: the
 item goes offline; external alarms are refreshed with ConditionRefresh). The coarse
 `BaseModelChangeEvent` (recreate everything) is handled only with
 `OPXC_BASE_MODEL_CHANGE_EVENT = YES`. Events within 10 s are handled once; the server must
 support Read and Browse.
 ## 4. Certificate exchange (first connection; the user does it)
@ -116,6 +147,11 @@ again (verified: reload connected within 5 s without a new exchange). For an ext
 its certificate arrives the same way; the client certificate
 (`…\pkiclient\own\certs\<host>_<PROCESS>.der`) must be trusted on that server.
 From R1.05 the client warns in the Historical Alarm Overview and the UMH message log before its
 own or the server's certificate expires (IM 36K10E20 4th ed. §2.2; lead time
 `OPXC_CERT_EXP_PERIOD_WARN`, 2 months in the installed template). The own certificates made at
 installation were valid for 5 years on the R1.05 test server (verified 2026-10-08).
 ## 5. Check
 - `itmval -g -n CI-Eng-Sample.UA.COMM_OK` → 1; `UA.SRV_STATE` → 0 status 9;
@ -128,3 +164,31 @@ its certificate arrives the same way; the client certificate
 Items (`76_`), then points, subscription, station (`77_`), then the line (`78_`, stops the
 client process). Reset the OPC flags only if they were not there before.
 ## 7. Calling a method on an external OPC UA server (R1.04+, from docs)
 Source: IM 36K10L45 5th ed. §10.6, App. 1.3–1.4; IM 36K10E20 4th ed. §2.1.6. Not practiced.
 Installed on R1.05 (verified 2026-10-08): dataset `OPCUAC_METHOD_CALL2_DF`, loader
 `opcuac_method_u0104`, AOG displays `AOG_UAC_Method_Demo`, `AOG_UAC_Method_Call`,
 `AOG_UAC_MethodArg_Call(2)` with their symbols.
 1. **Class** for the method object (sample Java class `UAC_MTD_JBASE`): attribute `MTD_KEY`
   (holds the method name) and signals `MTD_TRG` (0 idle/done, 1 call, 2 failed), `MTD_RET`
   (result code as text; its quality holds the numeric code), `MTD_IN_ARG_0…` and
   `MTD_OUT_ARG_0…` (at most 10 each, same order and types as on the server). These names are
   reserved in that class. Use a class with a unique name per method object (App. 1.4).
 2. **Method** under the station (Engineering Module *Methods → Add method*, dataset
   `OPCUAC_METHOD_CALL2_DF`, name `<station>:<method>`): `OPC_NAMESPACE`, `OPC_NODE_ID_TYPE`,
   `OPC_NODE_ID`. If the server does not browse its method nodes: parent object node ID by hand
   (`MANUAL_OBJ_OPC_NODE_ID`, `OBJ_OPC_NAMESPACE`, `OBJ_OPC_NODE_ID_TYPE`, `OBJ_OPC_NODE_ID`) and
   argument types by hand (`MANUAL_ARGUMENT_CONFIGURATION`, `ARGUMENT_IN_n_TYPE` / `…OUT…`).
 3. **Point**, one per method: *Input + Output*, namespace `CIX_UAC_MTD`, type STRING, node ID
   `CIX_UAC_MTD`; connect it to the object's `MTD_TRG` signal (*Connected I/O point*). Set
   `MTD_KEY` to the method name. The process area goes on `MTD_TRG` (the method form no longer
   has one). `MTD_TRG` shows status UPD_OFFLINE.
 4. **Symbol and display** for the class (see the AOG demo display), then trigger from there.
 Upgrade from R1.03 (App. 1.3): R1.03 methods called through dataset fields
 (`OPCUAC_METHOD_CALL_IN_DF` / `…_OUT_DF`, both gone in R1.05) stop working. Rebuild the class
 with the `MTD_*` members (*Extended reset enabled*, then reset), rebuild symbols and displays,
 and re-save (or copy and re-add) any method with String or Boolean input arguments.
--- a/.claude/skills/data-access/tasks/rdbms-exposure.md
+++ b/.claude/skills/data-access/tasks/rdbms-exposure.md
@ -11,7 +11,9 @@ status: tested in R1.05 only
 Edition on a separate domain-joined host). Not re-tested on R1.03 or on CI-Eng-Sample (user
 decision 2026-10-02). On the R1.03 development machine the files `dbc.sup`,
 `data_exposure_df.dss` and `item_df.dss` were checked read-only and match what is described
-here (`dbc.sup` is identical in R1.03 and R1.05).
+here (`dbc.sup` is identical in R1.03 and R1.05 apart from the site's `DEM_CONNECTION` line;
 `data_exposure_df.dss` and `item_df.dss` identical; re-checked read-only on the R1.05 test
 server 2026-10-08).
 **Changes live configuration on two systems** (SQL Server and CI Server): follow the user's
 chosen way of working. SQL Server changes on a shared server need the owner's agreement.
--- a/.claude/skills/equipment/SKILL.md
+++ b/.claude/skills/equipment/SKILL.md
@ -1,16 +1,21 @@
 ---
 name: equipment
 description: >-
-  CI Server R1.03 EQUIPMENT Service: lines, stations, scan types, I/O points and conversion
+  CI Server R1.05 EQUIPMENT Service: lines, stations, scan types, I/O points and conversion
  types. Use when the user wants to connect CI Server to a PLC, RTU or other device (Modbus
  TCP/RTU, STARDOM FCX, FA-M3, DNP3, IEC 60870-5-104, IEC 61850, MQTT, OPC …), define or
  remove a line, station, scan type or point, connect an item to an I/O address, set a station
  off-scan or suppress outputs, add a station communication status item, run CI Server as a
  Modbus slave, force a faster scan (eqpfrcscn), check equipment statistics or use the
-  equipment debugger (eqpdbg). Sources IM 36K10L40-01EN, IM 36K10L41-01EN, IM 36K10C10-01EN §4.1.
+  equipment debugger (eqpdbg), or work with the IEC 60870-5-104 / IEC 61850 EQT managers
  (eqt104, eqt850, eqtdbg, eqtfrcscn, IEC 61850 report control blocks, upgrade from R1.03).
  Sources IM 36K10L40-01EN, IM 36K10L41-01EN, IM 36K10C10-01EN §4.1.
 ---
-# Equipment (R1.03)
+# Equipment (R1.05)
 Re-checked on R1.05 on 2026-10-08 (read-only): Modbus datasets, setup files and tools are
 identical to R1.03. IEC 60870-5-104 and IEC 61850 now run as **EQT** managers (see below).
 Background: `knowledge/manuals/IM36K10L41-01EN.md` (line types, station parameters,
 conversion types, Modbus, driver table), `IM36K10L40-01EN.md` (forced scan, statistics,
@ -24,6 +29,11 @@ Rules:
 - Outputs write to real devices: never write to a production station's output points without
  the user's explicit approval.
 - `eqpdbg`: only the read-only actions (see L40 summary) unless the user approves.
 - IEC 104 and IEC 61850 lines (R1.04 and later) run under an `EQT<name>` manager (`eqt104`,
  `eqt850`, started by `etaman`). `eqpdbg` and `eqpfrcscn` only reach `EQP*` managers; for EQT
  managers use `eqtdbg` (default process `EQT`, same menu and same read-only actions) and
  `eqtfrcscn` (template `tls\tpl\eqtfrcscn.tpl`). The manual does not describe these tools
  (ISS-078).
 | Task | File | Status |
 |---|---|---|
@ -33,3 +43,4 @@ Rules:
 | Forced scan (`eqpfrcscn`), hourly statistics (`eqpiostat`) | L40 summary | from docs (statistics empty, ISS-021) |
 | OPC UA client lines/stations/points (also OPC DA/A&E) | skill `data-access`, task `opcua-client.md` | verified (OPC UA loopback) |
 | Other protocols | L41 summary §3.8–3.40 | from docs (no hardware) |
 | IEC 61850 / IEC 104 on R1.04 and later: EQT managers, report control blocks, upgrade from R1.03 | L41 summary §3.32 and App. 1 | from docs; installed files checked on R1.05 |
--- a/.claude/skills/equipment/tasks/modbus-station.md
+++ b/.claude/skills/equipment/tasks/modbus-station.md
@ -1,8 +1,8 @@
 ---
 task: Modbus TCP station by quick load (line, station, scan type, points, items)
-version: R1.03
+version: R1.05 (first written for R1.03)
 source: IM 36K10L41-01EN §2, §3.1–3.2, §3.6–3.7; IM 36K10C10-01EN §4.1; practiced on CI-Eng-Sample 2026-09-30
-status: verified
+status: verified on R1.03 (2026-09-30); on R1.05 the datasets, setup files and start scripts were checked identical (2026-10-08, read-only), not re-run (the sample is not loaded on the shared R1.05 server)
 ---
 # Modbus TCP station by quick load
@ -24,7 +24,9 @@ CI Server ships a Modbus slave "mirror" that needs no hardware:
 Started by hand from a normal prompt they run until logoff or CI Server restart. To start
 them with CI Server, an administrator copies `examples/CI-Eng-Sample/equipment/
 eqpciengslv_start.cmd` and `_stop.cmd` to `%TLS_ROOT_PATH%\tls\com`: `equipment_start.cmd`
-runs every `eqp*start.cmd` there.
+runs every `eqp*start.cmd` there. On R1.05 (checked 2026-10-08) it also runs `eqt*start.cmd`
 and, on the host node, every `?*_equipment_start.cmd` (with `?*_equipment_stop.cmd` called
 from `equipment_stop.cmd`), which is a cleaner hook for such extensions.
 ## 2. Line (`MODBUS_LINE_DF`)
@ -112,7 +114,7 @@ on-scan (output method *On change and connect*).
   and `tls\sav` files.
 4. The status item and section with the other items.
-## Test system (2026-09-30)
+## Test system (R1.03, 2026-09-30)
 Full cycle on CI-Eng-Sample: loaded, `SETPOINT` 1234/4321/2468 and `CMD` 1/0 read back
 through Modbus on `READBACK`/`FEEDBACK`, off-scan/on-scan checked, removed (manager stopped,
--- a/.claude/skills/installation-security/SKILL.md
+++ b/.claude/skills/installation-security/SKILL.md
@ -1,15 +1,20 @@
 ---
 name: installation-security
 description: >-
-  CI Server R1.03 installation, upgrade and Windows/IT security. Use when the user wants to
+  CI Server R1.05 installation, upgrade and Windows/IT security. Use when the user wants to
  prepare Windows for CI Server, check whether a machine meets the setup requirements, install,
-  reinstall, upgrade or uninstall CI Server, apply or extend a licence, install CI Server Remote
+  reinstall, upgrade or uninstall CI Server, merge configuration files after an upgrade
-  Connect, set up Vnet/IP drivers or network addresses, apply the IT Security Tool, check or
+  (automatic merge, jupgutl, upgrade report), apply or extend a licence, install CI Server Remote
-  open firewall ports, manage the CIX_ groups and CIX_PROCESS account, or run CI Server on a
+  Connect, set up Vnet/IP drivers or network addresses, apply the IT Security Tool (IT security
-  virtual machine. Sources IM 36K01C10-01EN and IM 36K01C30-01EN.
+  version 2.0 or 3.0), set up LAPS, check or open firewall ports, manage the CIX_ groups and
  CIX_PROCESS account, install CI Server next to PRM, or run CI Server on a virtual machine.
  Sources IM 36K01C10-01EN and IM 36K01C30-01EN (5th editions).
 ---
-# Installation and security (R1.03)
+# Installation and security (R1.05)
 First written for R1.03 (frozen on branch `r1.03`), re-checked against the R1.05 manuals
 (5th editions, Feb. 2026) and the R1.05 test server on 2026-10-08.
 Background: `knowledge/manuals/IM36K01C10-01EN.md` (Setup) and
 `knowledge/manuals/IM36K01C30-01EN.md` (Security Guide). Known issues:
@ -20,13 +25,23 @@ Rules:
 - Installing, upgrading, changing Windows settings or IT security needs an elevated session,
  changes the machine and often needs restarts: follow the user's chosen way of working and
  confirm before each step. In *prepare only* mode, produce a checklist for the user.
- Never copy old setup files over new ones after an upgrade: compare and merge.
+- Never copy old setup files over new ones after an upgrade: compare and merge. The R1.05
  automatic merge does not cover every file (Setup summary §3).
 - Before a reinstall or upgrade, set the startup type of *CI Service* and *VAGW Bossd* to
  Manual. From R1.04 VAGW Bossd is stopped and started with `vagwstarter.exe` (Setup summary §3).
 - Read paths from the `TLS_*` variables: the manuals print the default install paths, which
  may not be where CI Server is installed (ISS-086).
 - IT security (IT Security Tool, CIX_ groups, LAPS) is **from docs only** for R1.05: the R1.05
  test server runs Windows Server 2025, where the tool is not supported, and it is not installed.
 | Task | Where | Status |
 |---|---|---|
-| Check a machine against the setup and security requirements | `tasks/setup-check.md` | verified |
+| Check a machine against the setup and security requirements | `tasks/setup-check.md` | verified (R1.03; R1.05 checks run one by one) |
 | New installation (physical, VM, dual-redundant): order of work, Windows settings, Vnet/IP, install, IT security, licence | Setup summary §2 | from docs |
-| Start/stop, reinstall, upgrade (incl. HAC), extend licence, uninstall | Setup summary §3 | from docs |
+| Start/stop CI Server and VAGW Bossd, reinstall, upgrade (incl. HAC), extend licence, uninstall | Setup summary §3 | from docs |
 | Upgrade with automatic merge of configuration files (installer checkbox, `jupgutl`, merge report and conflict log) | Setup summary §3 | from docs (files and merge patterns checked on the R1.05 test server) |
 | Install CI Server Remote Connect; web ports | Setup summary §2.4 | from docs |
-| Firewall ports for CI Server and drivers | Security Guide summary §3 | from docs (web, DURM, SMDMON ports checked) |
+| CI Server and PRM on one computer or connected | Setup summary §4 | from docs |
-| IT Security Tool, user management types, CIX_ groups/accounts, change service account | Security Guide summary §2, §5 | from docs |
+| Firewall ports for CI Server and drivers | Security Guide summary §3 | from docs (web, DURM, SMDMON, RESTful API ports checked on R1.03 / R1.05) |
 | IT Security Tool (version 2.0 / 3.0), user management types, CIX_ groups/accounts, change service account | Security Guide summary §2, §5, §7 | from docs |
 | LAPS (linked domain management with IT security 3.0) | Setup summary §2.1.6, Security Guide summary §7 | from docs |
--- a/.claude/skills/installation-security/tasks/setup-check.md
+++ b/.claude/skills/installation-security/tasks/setup-check.md
@ -1,27 +1,43 @@
 ---
 task: Check a machine against the CI Server setup and security requirements
-version: R1.03
+version: R1.05 (first written for R1.03)
-source: IM 36K01C10-01EN §1, §2.1.2, §3.2.12; IM 36K01C30-01EN §2.2, §3.2; practiced on the test system 2026-09-30
+source: IM 36K01C10-01EN 5th ed. §1.3.2, §1.3.3, §2.1.2, §2.1.3, §3.3.15; IM 36K01C30-01EN 5th ed. §2.2.1, §3.2, §3.5.4, §3.7; practiced on the R1.03 test system 2026-09-30 and checked read-only on the R1.05 test server 2026-10-08
-status: verified (2026-09-30)
+status: verified on R1.03 (2026-09-30); R1.05 checks verified one by one (R1.05 test server, 2026-10-08), script itself not yet run on R1.05
 ---
 # Setup check (read-only)
 ```
 powershell -NoProfile -ExecutionPolicy Bypass -File tools\setup_check.ps1
 powershell -NoProfile -ExecutionPolicy Bypass -File tools\setup_check.ps1 -Version 1.03.00
 ```
-Run from the repo root, preferably elevated. Changes nothing. One line per check:
+Run from the repo root, preferably elevated. Changes nothing. The default target is R1.05
 (`-Version 1.05.00`); use `-Version 1.03.00` for an R1.03 machine. One line per check:
 `[OK]` matches the manual, `[DIFF]` differs, `[CHECK]` needs a human decision.
 The script must be on the machine being checked. On a server you reach only remotely, the
 user copies it there (or runs the checks below by hand); it writes nothing.
 ## What it checks
 | Area | Checks |
 |---|---|
-| CI Server | Installed version (1.03.00), CI Service state, startup type and account (`.\CIX_PROCESS`), VAGW service |
+| CI Server | Installed version (1.05.00 by default), CI Service (`StartCIServer`) state, startup type and account (`.\CIX_PROCESS`), VAGW service |
-| Windows | Supported OS, visual effects, processor scheduling, virtual memory (custom, 1.5 × RAM), power plan, fast startup, Windows Defender policy, automatic updates policy, scheduled defrag and component cleanup, .NET 3.5, DCOM authentication level, display scale, 8dot3 names, regional settings |
+| Windows | Supported OS for the target version, visual effects, processor scheduling, virtual memory (custom, 1.5 × RAM), power plan, fast startup, Windows Defender policy (with the R1.05 exceptions), automatic updates policy, scheduled defrag and component cleanup, .NET 3.5, DCOM authentication level, display scale, 8dot3 names, regional settings |
-| IT security | `CIX_OPERATOR`, `CIX_ENGINEER`, `CIX_MAINTENANCE`, `CIX_OPC` groups, `CIX_PROCESS` / `CTM_PROCESS` users, IT Security Tool installed |
+| IT security | `CIX_OPERATOR`, `CIX_ENGINEER`, `CIX_MAINTENANCE`, `CIX_OPC` groups, `CIX_PROCESS` / `CTM_PROCESS` users, IT Security Tool installed (program folder or the IT security 3.0 folder under ProgramData) |
-| Firewall | Profiles enabled; inbound allowed for TCP 8080, 8443, UDP 17001, 17101, 18002 |
+| Firewall | Profiles enabled; inbound allowed for TCP 8080, 8443, UDP 17001, 17101, 18002; on R1.05 also TCP 34597 (RESTful API) |
 R1.05 supported OS (IM 36K01C10 5th ed. §1.3.2), all 64-bit: Windows 10 Enterprise / IoT
 Enterprise LTSC 2019 and 2021, Windows 11 Pro and Enterprise, Windows 11 Enterprise / IoT
 Enterprise LTSC 2024, Windows Server 2019 / IoT 2019, 2022 / IoT 2022 and 2025 / IoT 2025
 (Standard). On Windows 11 Pro/Enterprise and Server 2025 the Vnet/IP drivers and the IT
 Security Tool are not supported. Windows 10 Pro/Enterprise (non-LTSC), LTSB 2016 and Server
 2016 are no longer listed.
 Defender (IM 36K01C10 5th ed. §2.1.2, IM 36K01C30 5th ed. §3.5.4): normally turned off by
 group policy, but it must stay on with Windows 11 Pro 24H2, and it cannot be turned off on
 Windows 10 LTSC 2021 or Windows 11 LTSC 2024. The script reports `[CHECK]` for those.
 ## Reading the result
@ -29,21 +45,51 @@ Run from the repo root, preferably elevated. Changes nothing. One line per check
  Setup summary's Windows settings table (`knowledge/manuals/IM36K01C10-01EN.md` §2) or by
  running the IT Security Tool.
 - The script finds the firewall rules only as "some rule allows this port"; check the rule
-  scope separately for production.
+  scope separately for production. If the active profile is switched off, no rule is needed
  and every port is open: check which profile is active (`Get-NetConnectionProfile`).
 - Listening ports (useful when there are no rules): `Get-NetTCPConnection -State Listen` and
  `Get-NetUDPEndpoint` with the owning process. On R1.05 the RESTful API server (`jrstsrv`,
  a `javaw` process) also listens on TCP 7073, which no manual mentions (ISS-087): do not open
  it in the firewall.
 - Also read `%TLS_LOG_PATH%\ci_start.log` after a start: every service should report
-  `… started` and the log ends with `CI Server started`; look for `-E-` and `failed` lines.
+  `… started` and there should be a `CI Server started` line; look for `-E-` and `failed`
-  The first lines show the version and build (e.g. `R1.03.00 … (r10200M)`).
+  lines. The log keeps growing after the start (equipment messages), so the `CI Server
  started` line is not always last. The `UMHLOGTOO` line near the top shows the version and
  build (R1.03: `R1.03.00 … (r10200M)`, R1.05: `R1.05.00 … (r11609M)`).
 - The web ports actually used are `SECURE_PORT_NUMBER` / `NON_SECURE_PORT_NUMBER` in
-  `%TLS_ROOT_PATH%\tls\sup\jwuiisg.sup` (8443 / 8080 by default).
+  `%TLS_ROOT_PATH%\tls\sup\jwuiisg.sup` (8443 / 8080 by default); the RESTful API port is
  `JRST_NETWORK_PORT` in `jrstsrv.sup` (34597 by default, R1.05).
 - Installed updates: `Get-HotFix`. `wmic qfe list full` (Setup App. 1.3) fails on Windows
  Server 2025 / 24H2, where WMIC is no longer installed (ISS-088).
 - Folder rights (not in the script): setup files can hold passwords (e.g. `dbc.sup`). Check
  who can read and change them:
  `foreach ($r in (Get-Acl "$env:TLS_ROOT_PATH\tls\sup").Access) { "{0} : {1}" -f $r.IdentityReference, $r.FileSystemRights }`.
  Under Program Files, Users can read; an install outside Program Files (e.g.
-  `C:\Yokogawa\CIServer`, seen on an R1.05 system) can inherit *Authenticated Users: Modify*,
+  `C:\Yokogawa\CIServer`, as on the R1.05 test server) can inherit *Authenticated Users:
-  so any signed-in user can change setup files (ISS-061). Fixing it is a site decision (IT
+  Modify*, so any signed-in user can change setup files (ISS-061). Fixing it is a site
-  Security Tool).
+  decision (IT Security Tool).
 - A local group `RDC_GA_CLIENT` with member `CIX_PROCESS` can exist on a machine that is not
  a dual-redundant platform and has no IT security applied (seen on R1.05). It needs no
  action (ISS-089).
-## Test system result (2026-09-30)
+## R1.05 test server result (2026-10-08)
 Checks run one by one, read-only (the script itself was not run there). Windows Server 2025
 Datacenter (24H2) virtual machine, domain member, CI Server R1.05.00 (r11609M) installed in
 `C:\Yokogawa\CIServer` without the IT Security Tool.
 - Matched: CI Service running, automatic, account `.\CIX_PROCESS`; fast startup off; High
  performance plan; processor scheduling Programs; 8dot3 names enabled; 100 % scale; web
  ports 8443/8080; RESTful API on 34597; DURM UDP 17001/17101 and SMDMON UDP 18002 listening.
 - Differed: Datacenter edition is not listed (only Standard); firewall profile for the
  domain network off and no CI Server inbound rules; Defender on; automatic updates, defrag
  and component cleanup not disabled; virtual memory not a custom size; .NET 3.5 not
  installed; no `CIX_` groups, no `CTM_PROCESS`, no VAGW Bossd service (IT Security Tool not
  installed and not supported on Server 2025, so IT security cannot be verified on this server).
 - `ci_start.log`: all services started; the same odbsrv SSL certificate error as on R1.03
  (ISS-008).
 ## R1.03 test system result (2026-09-30)
 Windows 10 Pro 19045 development PC without the IT Security Tool: 16 OK, 5 CHECK, 15 DIFF.
 Differences: firewall domain/private profiles off; no `CIX_` groups or `CTM_PROCESS` (IT
@ -53,4 +99,4 @@ disabled. Web ports 8443/8080. `ci_start.log`: all services started, one SSL cer
 (`InitializeSslCtx(): SSL_CTX_use_certificate_chain_file() failed`): the ODBC server `odbsrv`
 has `USESSL = YES` but no certificate in `%TLS_ROOT_PATH%\tls\pki\odbsrv`, so it exits at
 start (harmless unless ODBC is used; fix in skill `data-access`, task `access-checks.md`;
-`knowledge/issues.md` ISS-008).
+`knowledge/issues.md` ISS-008). Windows 10 Pro is no longer a supported OS for R1.05.
--- a/.claude/skills/system-management/tasks/load-remove-records.md
+++ b/.claude/skills/system-management/tasks/load-remove-records.md
@ -1,7 +1,7 @@
 ---
 task: Load and remove dataset records with dssqld (quick load)
 version: R1.03
-source: IM 36K10J10-01EN §2.9.2, §5.6; IM 36K10L45-01EN §9.10–9.11; practiced with CI-Eng-Sample 2026-09-30
+source: IM 36K10J10-01EN §2.9.2, §5.6; IM 36K10L45-01EN §10.12–10.13 (5th ed.; §9.10–9.11 in the R1.03 edition); practiced with CI-Eng-Sample 2026-09-30
 status: verified
 ---
--- a/knowledge/issues.md
+++ b/knowledge/issues.md
@ -21,12 +21,12 @@ development system (see "Test system" in `progress.md`); they do not exist on ot
 |---|---|---|---|---|---|---|
 | ISS-001 | 2026-09-30 | ITEM (`itmval`) | Writing an item with `itmval -p -n AID.WRPS.SIM.INFLOW -v 400` added the `uoff` option flag (options 0x…8a → 0x…8e). The flag stayed after writing the original value back. Meaning of `uoff` unknown; not found in the EN manuals by text search. | closed | 2026-09-30 (phase 5): IM 36K10C10 §3.5 gives the option bits: 1 blocked, 2 offline, **4 updated offline** (written by an application while offline), 8 acknowledged, **16 updated blocked**, 32 direct alarm, 64 delayed alarm. 0x8a = offline + acknowledged (+0x80, not documented); +4 = 0x8e, so `uoff` = updated offline and `ublk` = updated blocked. Matches all observations. Not yet found: how to clear the flags (probably on the next update from the station). Closed 2026-09-30 (confirmed by user). Earlier notes: writing internal sample items (`CI-Eng-Sample.*`, no station) does **not** set `uoff` (options stay 0x…88), so it is tied to station-connected items (the AID item was already `off`, its station not communicating). Still to find: meaning and how to clear it (ITEM Service IM 36K10L35/L36, Engineering Module I/O Processes IM 36K10C10). Revisit in phase 5 with a station item. 2026-09-30 later: unblocking a sample item left the flag `ublk` (after `blk` was cleared), so `u…` flags may mean "was …" (un-blocked / un-offline). Still unconfirmed. | `.claude/skills/system-management/tasks/read-write-item.md` (replace the `uoff` note under "Read the current value"); `knowledge/progress.md` row "Write an item with `itmval -p`" |
 | ISS-002 | 2026-09-30 | DATABASE (`dsschk`) | `dsschk -d ITEM_DF -v` (check only) exits 0 with no console output and nothing new in `umhlog.log`. Where results are reported is unknown. | closed | Closed 2026-09-30 (confirmed by user). 2026-09-30: `dsschk -e -v` prints a start/end line per dataset (228 checked, no problems) and logs to `umhlog.log`. Plain `dsschk` only compares copies between nodes, so it prints nothing on a single-node system. `ismchk` needs a database file name (usage: `ismchk data_base_name`), not run yet. | Create `.claude/skills/system-management/tasks/consistency-check.md` and add it to that skill's `SKILL.md`; `knowledge/manuals/IM36K10J10-01EN.md` §4.1.1 consistency tools (add where output goes); `knowledge/progress.md` row "Consistency check" |
-| ISS-003 | 2026-09-30 | DATABASE (`dssqld`) | Filtered export (`dssqld -e <out> <filter>.qli`) failed with a guessed filter syntax (`@ITEM_DF`, `@FIELD`, `@SELECT`). | closed | Closed 2026-09-30 (confirmed by user). 2026-09-30: the quick load **data** format is now known and verified (`@LANGUAGE`, `@VERSION`, `@FIELDS`, `@<DATASET>`, quoted CSV records, `\` continuation, `!` comments; IM 36K10L45 §9.11). Filter syntax found (IM 36K10L50 §3.6) and practiced, awaiting confirmation: a file with `@SELECT`, then the filter in single quotes (strings in double quotes), then `@<DATASET>`; run `dssqld -e <out> <filter>.qli`. `ITEM_HISTORY` returns nothing unless the filter names `ITEM_NAME` and a `SAMPLE_TIME` range (`SAMPLE_TIME > "dd-mm-yyyy hh:mm:ss" and SAMPLE_TIME < ...`). | `.claude/skills/system-management/tasks/export-dataset.md` section "Filtered exports"; `knowledge/manuals/IM36K10J10-01EN.md` §5.6 step 1; `knowledge/progress.md` row "Export a dataset" |
+| ISS-003 | 2026-09-30 | DATABASE (`dssqld`) | Filtered export (`dssqld -e <out> <filter>.qli`) failed with a guessed filter syntax (`@ITEM_DF`, `@FIELD`, `@SELECT`). | closed | R1.05 (2026-10-08): the quick load format section is now IM 36K10L45 5th ed. §10.13 (was §9.11). Closed 2026-09-30 (confirmed by user). 2026-09-30: the quick load **data** format is now known and verified (`@LANGUAGE`, `@VERSION`, `@FIELDS`, `@<DATASET>`, quoted CSV records, `\` continuation, `!` comments; IM 36K10L45 §9.11). Filter syntax found (IM 36K10L50 §3.6) and practiced, awaiting confirmation: a file with `@SELECT`, then the filter in single quotes (strings in double quotes), then `@<DATASET>`; run `dssqld -e <out> <filter>.qli`. `ITEM_HISTORY` returns nothing unless the filter names `ITEM_NAME` and a `SAMPLE_TIME` range (`SAMPLE_TIME > "dd-mm-yyyy hh:mm:ss" and SAMPLE_TIME < ...`). | `.claude/skills/system-management/tasks/export-dataset.md` section "Filtered exports"; `knowledge/manuals/IM36K10J10-01EN.md` §5.6 step 1; `knowledge/progress.md` row "Export a dataset" |
 | ISS-004 | 2026-09-30 | ITEM (`itmval`) | `itmval -g -a <1..5>` returns `ITM-E-WRONG_ATT` on `AID.WRPS.*` items, so reading limits is unproven. | closed | Closed 2026-09-30 (confirmed by user). On `CI-Eng-Sample.TANK1.LEVEL` (limits set) `-a 1..5` returned deadband 0, low 20, high 80, low-low 10, high-high 90. The error only occurs on items without limits. | `.claude/skills/system-management/tasks/read-write-item.md` (limits section); `knowledge/progress.md` row "Read an item with `itmval -g`" |
 | ISS-005 | 2026-09-30 | DATABASE (`dssqld`) | Loading `04_item_his_df.qli` straight after creating the storage group gave 2 errors once; three other runs were clean. Error text not captured. | closed | Added a 5 s pause in `load.cmd`. No recurrence since: every full sample reload in phases 6-12 (latest 2026-10-01) loaded `04_item_his_df.qli` with 0 errors. Closed 2026-10-01 (confirmed by user). | `examples/CI-Eng-Sample/load.cmd`; `.claude/skills/system-management/tasks/load-remove-records.md` |
 | ISS-006 | 2026-09-30 | HISTORY (`ithloahis`) | Samples dated before the start of the current storage unit were not stored (no error shown); samples after it were. Also, a new storage group stored nothing until CI Server was restarted. | closed | Closed 2026-10-01 (confirmed by user). Confirm with History Management (IM 36K10L20) in phase 9: how to load into older units, and whether a restart is really required. 2026-09-30 (phase 5): IM 36K10L35 §1.3/§5 explains the first part: event storage picks the unit by time stamp, never older than 60 units, and within the storage process's `gap_time` (ITHEEX/ITHEIX 2880 min) and, for EVENT/ITEM, `max_sample_delay` (ITHEIX 14400 min); older data needs earlier unit files (`hisdbg`, `hisrecover`, `isfrename`), `ithrecover <group> -p` and a restart. Practice in phase 9. 2026-10-01 (phase 9, verified): (1) restart **is** required — `CIENG_SCAN10S` / `CIENG_AGG` loaded at 11:54 and `CIENG_EVENT` reloaded at 11:32 stored nothing until the 12:00 restart, then stored at once. (2) The first unit of a new Event/Item or Aggregation group is dated 2 days back (= `gap_time` 2880 min), but samples loaded into that pre-restart unit (11:50, 30-Sep) were still dropped; samples inside the active unit (12:02) and inside a unit closed by a forced rollover (12:03 into unit 3,1) were stored. So: samples older than the first unit opened since the restart are dropped silently. Loading older data would need `hisrecover` / `isfrename` / `ithrecover` (not practiced). Proposed close: documented in `load-history.md` and skill `history-management`. | `.claude/skills/system-management/tasks/load-history.md`; `examples/CI-Eng-Sample/README.md`; `knowledge/manuals/IM36K10J10-01EN.md` command-line tools |
 | ISS-007 | 2026-09-30 | INTEGRATION (monitoring) | `intdskmon` wrote 61.9 for a C: drive that is 61.9 % used / 38.1 % free, although the manual says it monitors the disk free space rate. `intspawn` did nothing when the command path was ~130 characters; a short path worked (limit unknown). | closed | Disk value: the test showed **used** % (61.9 on a 61.9 % used disk), and the task file says so; installed behaviour is the reference. `intspawn` path limit: not measured (needs admin edits of `tls\sup\<name>.sup` and restarts for each length); guidance kept: put the command in a `.cmd` with a short path (other CI Server tools cut paths at 79 characters, ISS-020). Closed 2026-10-01 (confirmed by user). | `.claude/skills/system-management/tasks/monitoring-processes.md`; `knowledge/manuals/IM36K10J10-01EN.md` §4.1.6; `examples/CI-Eng-Sample/monitoring/` |
-| ISS-008 | 2026-09-30 | ACCESS (ODBC server `odbsrv`) | `ci_start.log` on the test system shows `CppServerAPI::Run() failed: InitializeSslCtx(): SSL_CTX_use_certificate_chain_file() failed.` right after ACCESS Service starts. Which component and certificate is not known. | closed | Closed 2026-10-01 (confirmed by user): cause known, ODBC server left as is (not licensed/used on the test system). Identify in phase 7. 2026-10-01 (phase 7): cause found. The message comes from the ODBC server `odbsrv` (ACCESS Service, Simba): `odbsrv.sup` has `USESSL = YES` and `access_start.cmd` points it at `%TLS_ROOT_PATH%\tls\pki\odbsrv\SampleServerCertificate.pem` / `SampleServerKey.pem`, but that folder does not exist and no sample certificate is installed. `odbsrv` exits right after start (`DUR-W-REM_PROC, Process ODBSRV exited unexpectedly`), port 1583 does not listen. Fix (admin, only if ODBC is licensed and wanted): install a certificate + key there, or set `USESSL = NO`. Not applied. Close when the user confirms. | `.claude/skills/installation-security/tasks/setup-check.md`; `knowledge/manuals/IM36K10L45-01EN.md` §1 (done); `.claude/skills/data-access/tasks/access-checks.md` (done) |
+| ISS-008 | 2026-09-30 | ACCESS (ODBC server `odbsrv`) | `ci_start.log` on the test system shows `CppServerAPI::Run() failed: InitializeSslCtx(): SSL_CTX_use_certificate_chain_file() failed.` right after ACCESS Service starts. Which component and certificate is not known. | closed | R1.05 (2026-10-08): unchanged on the R1.05 test server: same `ci_start.log` message, `tls\pki\odbsrv` missing, port 1583 not listening, `odbsrv.sup` identical. Closed 2026-10-01 (confirmed by user): cause known, ODBC server left as is (not licensed/used on the test system). Identify in phase 7. 2026-10-01 (phase 7): cause found. The message comes from the ODBC server `odbsrv` (ACCESS Service, Simba): `odbsrv.sup` has `USESSL = YES` and `access_start.cmd` points it at `%TLS_ROOT_PATH%\tls\pki\odbsrv\SampleServerCertificate.pem` / `SampleServerKey.pem`, but that folder does not exist and no sample certificate is installed. `odbsrv` exits right after start (`DUR-W-REM_PROC, Process ODBSRV exited unexpectedly`), port 1583 does not listen. Fix (admin, only if ODBC is licensed and wanted): install a certificate + key there, or set `USESSL = NO`. Not applied. Close when the user confirms. | `.claude/skills/installation-security/tasks/setup-check.md`; `knowledge/manuals/IM36K10L45-01EN.md` §1 (done); `.claude/skills/data-access/tasks/access-checks.md` (done) |
 | ISS-009 | 2026-09-30 | Security Guide | DCOM port range printed as 20500–20550 in the firewall table but "2500–20550" in the OPC configuration table. Taken as a typo for 20500–20550. | closed | Confirm on a system with IT security applied. Closed 2026-10-01 (confirmed by user). | `knowledge/manuals/IM36K01C30-01EN.md` §4 |
 | ISS-010 | 2026-09-30 | ITEM (sub-items) | The Integrator sub-item adds value × seconds; setting `TIME_UNIT` = Hour made no difference (1 per second while the main item was 1). The Tutorial lists a time unit only for Rate-of-Change. | closed | 2026-09-30 (phase 5): IM 36K10C10 §3.2 and `itm.sup` answer it: the integral is divided by the **integration granule** `itm_int_secs` (label "Integration granule, sec.") in `itm.sup` — **system-wide**, installed value 1 (seconds); 60 = minutes, 3600 = hours. `TIME_UNIT` only applies to Rate-of-Change. Practiced 2026-09-30: set to 60 and restarted → `CI-Eng-Sample.PUMP1.RUNNING.RUN_SECONDS` rose exactly 1.0 in 60 s; restored to 1 (file identical to backup) → 8 in 8 s. Existing integrator values are not converted when the granule changes. Closed 2026-09-30 (confirmed by user). | `examples/CI-Eng-Sample/02b_sub_item_df.qli`; `knowledge/manuals/IM36K10G10-01EN.md` |
@ -51,9 +51,9 @@ development system (see "Test system" in `progress.md`); they do not exist on ot
 | ISS-029 | 2026-09-30 | PROCESS (Java) | IM 36K10P11 §10.4 says a new Java class must be reset before objects are added, otherwise the code does not take effect. A Java class inserted with `COMPILE` 1 by `dssqld` ran its first object correctly without any reset (twice, including a full sample reload). | open | Installed behaviour is the reference; keep "reset after changing a class that has objects". Check whether the Engineering Module path (compile without quick load) behaves differently. | `knowledge/manuals/IM36K10P11-01EN.md` §7; `.claude/skills/class-object-engineering/tasks/java-class.md` |
 | ISS-030 | 2026-10-01 | BUS (UMH tools) | `umhman` (hex code → text) crashes with redirected input (bash: segmentation fault 139 with CRLF input; PowerShell `Start-Process -RedirectStandardInput`: 0xC0000005); with an argument it only prompts. `umhtestprog` prints `UMH TEST UTILITY` and crashes (segmentation fault). `umhmsg 8010008` stops with `umh_panic: …umhmsg.exe, license expired` although other tools (`dssqld`, `itmval`) still worked at that time. | closed | Retested 2026-10-01 right after a CI Server restart: all three work — `umhman` with piped input (bash, LF or CRLF; via `cmd <` too), `umhmsg 083A001B text "…"` writes the message to `umhlog.log` (process `UMHMSG_<pid>`, prints nothing), `umhtestprog` runs its self-test. The earlier failures came late in an unlicensed session (licence nearly expired). `itmval -f` (ISS-022) still crashes on a fresh start, so it is a separate fault. Closed 2026-10-01 (confirmed by user). | `.claude/skills/system-management/tasks/bus-utilities.md`; `knowledge/manuals/IM36K10L30-01EN.md` §3 |
 | ISS-031 | 2026-10-01 | LICENCE (unlicensed node) | The unlicensed test node counts down about 1 hour of run time per CI Server start (`License time left` in `smd_<node>_LOW_smdsnp_general.log`, 3600 s → `*** license problem : 3 ***`); then `dssqld`/`itmval` stop with `license expired` and `ISF-F-LIC_PROB, DATABASE Service is not licensed`. A PC sleep pauses the count (start 17:25, ran out 09:52 next day). Restart of the CI Service resets it (verified 2026-10-01, back after ~45 s). | closed | Closed 2026-10-01 (confirmed by user): known limitation of the unlicensed test system, documented in system-check. Known limitation of the test system, documented in `system-check`. Plan tests in ≤ 1 h blocks. Close when the user confirms. | `.claude/skills/system-check/SKILL.md` §3 (done) |
-| ISS-032 | 2026-10-01 | ACCESS (OPC UA server node IDs) | IM 36K10L45 §10.3 shows CI Server node IDs (`{"nsid":"32"}`, `{"0":"Value","itnm":"ITEM1"}`) and the CI Server namespace `http://www.yokogawa.com/CI_Server/` (ns 3) but not which namespace the **entities** use. With that URI (or `urn:<host>:Yokogawa:CI_SERVER_OPC_UA_SERVER`) the client point was silently not monitored. Browsing (`OPCUAC_TAG_DF`) shows sections/items in **`urn:Yokogawa:CI_SERVER_OPC_UA_SERVER`**; with it `{"0":"Value","itnm":"<item>"}` and `{"0":"Value","nsid":"<n>"}` both work. IM 36K10E20 §2.2.6 also asks to enable `OPXUAS_USE_NAME_NODEIDS` and restart for CI client ↔ CI server; not needed on the test system. | closed | Closed 2026-10-01 (user decision: installed software is the reference). Installed software is the reference (standing user decision). Close when the user confirms. | `knowledge/manuals/IM36K10L45-01EN.md` §7 (done); `knowledge/manuals/IM36K10E20-01EN.md` §3 (done); `.claude/skills/data-access/tasks/opcua-client.md` (done) |
+| ISS-032 | 2026-10-01 | ACCESS (OPC UA server node IDs) | IM 36K10L45 §10.3 shows CI Server node IDs (`{"nsid":"32"}`, `{"0":"Value","itnm":"ITEM1"}`) and the CI Server namespace `http://www.yokogawa.com/CI_Server/` (ns 3) but not which namespace the **entities** use. With that URI (or `urn:<host>:Yokogawa:CI_SERVER_OPC_UA_SERVER`) the client point was silently not monitored. Browsing (`OPCUAC_TAG_DF`) shows sections/items in **`urn:Yokogawa:CI_SERVER_OPC_UA_SERVER`**; with it `{"0":"Value","itnm":"<item>"}` and `{"0":"Value","nsid":"<n>"}` both work. IM 36K10E20 §2.2.6 also asks to enable `OPXUAS_USE_NAME_NODEIDS` and restart for CI client ↔ CI server; not needed on the test system. | closed | R1.05 (2026-10-08): sections are now IM 36K10L45 5th ed. §11.3 and IM 36K10E20 4th ed. §2.3; `OPXUAS_USE_NAME_NODEIDS` is still NO by default. Closed 2026-10-01 (user decision: installed software is the reference). Installed software is the reference (standing user decision). Close when the user confirms. | `knowledge/manuals/IM36K10L45-01EN.md` §7 (done); `knowledge/manuals/IM36K10E20-01EN.md` §3 (done); `.claude/skills/data-access/tasks/opcua-client.md` (done) |
 | ISS-033 | 2026-10-01 | ACCESS (Engineering Module OPC UA point) | Tested by the user: the point form's *Browse path* stops at the item (`Objects/CI-Eng-Sample/TANK1/INFLOW`) and stores the item **object** `{"nsid":"548"}`; the point is not monitored (revised sampling interval 0, connected item status 13, *Last value*/*Data type* empty). Typing `{"0":"Value","itnm":"CI-Eng-Sample.TANK1.INFLOW"}` in *Node Id* fixed it (values followed at once). Browsing into an item that is OPC visible but not *Read* fails (`UncertainNotAllNodesAvailable`, `OPXC-E-BRW_NODE`). | closed | Answered 2026-10-01 by the user: the browse dialog can expand the item; picking `…/LEVEL/Value` stored `{"0":"Value","nsid":"713"}` with *Last value* 85, *Data type* Double. So: pick the `Value` node, not the item. The `itnm` form stays the choice for quick load (`nsid` changes on reload). Closed 2026-10-01 (confirmed by user). | `knowledge/manuals/IM36K10E20-01EN.md` §2 (done); `.claude/skills/data-access/tasks/opcua-client.md` §3 (done) |
-| ISS-034 | 2026-10-01 | ACCESS (OPC UA server setup) | Installed vs IM 36K10L45 §10.5–10.6: `ServerConfig.xml` enables certificate user tokens (`EnableCertificate true`, manual false) and offers no `None` endpoint (only Basic256Sha256 / Aes128_Sha256_RsaOaep / Aes256_Sha256_RsaPss with Sign or SignAndEncrypt); the `rejected` folder is created only at the first rejection; `opxuas.sup` uses `OPXUAS_DYNAMIC_SCANRATE` (manual `OPXUAS_USE_DYNAMIC_SCANRATE`) and has `OPXUAS_SET_HIGH_PRIO_15` (not described); `opxsys.sup` has `OPXDAS_SET_LOG_LEVEL` (not described). Also `dur.sup` adaptive queue entry `OPCEXE` while the installed executors are `OPCEXE1`–`4`. | closed | Closed 2026-10-01 (user decision: installed software is the reference). Installed software is the reference (standing user decision). Close when the user confirms. | `knowledge/manuals/IM36K10L45-01EN.md` §4, §7 (done); `knowledge/manuals/IM36K10L30-01EN.md` §8 (done) |
+| ISS-034 | 2026-10-01 | ACCESS (OPC UA server setup) | Installed vs IM 36K10L45 §10.5–10.6: `ServerConfig.xml` enables certificate user tokens (`EnableCertificate true`, manual false) and offers no `None` endpoint (only Basic256Sha256 / Aes128_Sha256_RsaOaep / Aes256_Sha256_RsaPss with Sign or SignAndEncrypt); the `rejected` folder is created only at the first rejection; `opxuas.sup` uses `OPXUAS_DYNAMIC_SCANRATE` (manual `OPXUAS_USE_DYNAMIC_SCANRATE`) and has `OPXUAS_SET_HIGH_PRIO_15` (not described); `opxsys.sup` has `OPXDAS_SET_LOG_LEVEL` (not described). Also `dur.sup` adaptive queue entry `OPCEXE` while the installed executors are `OPCEXE1`–`4`. | closed | R1.05 (2026-10-08): all points still hold on the R1.05 test server; manual sections are now IM 36K10L45 5th ed. §11.6–11.7. Closed 2026-10-01 (user decision: installed software is the reference). Installed software is the reference (standing user decision). Close when the user confirms. | `knowledge/manuals/IM36K10L45-01EN.md` §4, §7 (done); `knowledge/manuals/IM36K10L30-01EN.md` §8 (done) |
 | ISS-035 | 2026-10-01 | ALARM (`ALDPRT`) | `ALDPRT` is running and connected (`almdbg` 1 shows `Events-send-to` rising with each alarm), `aldprt.sup` sets no log destination (so per IM 36K10L15 §4.3 it should log via UMH) and `EVENTS` includes `alarm`/`ackn`, but no alarm line appears in `tls\log\umhlog.log` for the CI-Eng-Sample HIGH / HIGH HIGH / acknowledge events. No other log file changed. Cause unknown (UMH filtering? output only with `LOGUMH` set explicitly?). | open | Rechecked 2026-10-01 after a restart: `aldprt.exe` runs; `umhlog.log` still has no alarm lines for the new `TANK1.LEVEL` HIGH alarm (only `ALD-I-ALDPRT_EXIT` at each licence shutdown). `fmfprt.sup` assigns printer function `ALARMS` to `ALDPRT`; destination `ALARMS` (policy *Automatic*) has **no device**, and `PRINTER_JOB_OVV` has no `ALDPRT` jobs. The `aldprt.sup` help says UMH is used only when no destination is enabled — the printer function may count as one. Next: test `LOGUMH` in `aldprt.sup` (admin, restart). Low priority: history and overviews are not affected. | `.claude/skills/alarm-management/tasks/item-alarming.md` (last line); `knowledge/manuals/IM36K10L15-01EN.md` §8 |
 | ISS-036 | 2026-10-01 | ALARM (setup) | Installed vs manuals: `alh.sup` has `DB-JRNL = WAL` and `DB-SYNC = OFF`, not described in IM 36K10L15 §3.4; storage group `ALH` has lifetime **52 weeks** while IM 36K10C20 §A7 says the default is 2 days (may have been changed on this system earlier — unknown); `aldprt.sup` uses `TIMEFMT` where the manual text also writes `TIMFMT`. | closed | Installed software is the reference (standing user decision). Close when the user confirms. Closed 2026-10-01 (confirmed by user). | `knowledge/manuals/IM36K10L15-01EN.md` §7, §8; `knowledge/manuals/IM36K10C20-01EN.md` §A7 |
 | ISS-037 | 2026-10-01 | ALARM (history fields) | `ALARM_CHRONO` records contain leftover or unreadable text: INFO events generated with `almdbg` 16 carry `INSTALL`/`UNIT`/`TAG`/`SUB` values from earlier events and non-ASCII bytes in `SOURCE`, `CATEGORY`, `CONDITION`; item events of `CI-Eng-Sample.TANK1.LEVEL` show `SUB` = `RoC` although the item has only the sub-item `MAX`. | closed | Rechecked 2026-10-01 after a restart: a new HIGH alarm on `CI-Eng-Sample.TANK1.LEVEL` (raised with `itmval -p`) gave a clean `ALARM_CHRONO` record (`INSTALL`/`UNIT`/`TAG` correct, `SUB` empty, `SOURCE`/`CATEGORY`/`CONDITION` empty), and the user's Current Alarm Overview showed correct columns. The leftover/garbled values are limited to the older records (INFO events made with the `almdbg` 16 test function and events from that session). Documented: treat `SUB`/`SOURCE`/`CATEGORY`/`CONDITION` as reliable only for normal item and OPC events. Closed 2026-10-01 (confirmed by user). | `.claude/skills/alarm-management/tasks/alarm-checks.md` §4 |
@ -80,7 +80,7 @@ development system (see "Test system" in `progress.md`); they do not exist on ot
 | ISS-058 | 2026-10-02 | DATA EXPOSURE (ITEM_HISTORY, manual vs installed) | IM 36K10G10 ch. 10 lists `ITEM_HISTORY` as an exposure source (filter required). The installed `dbc.sup` (R1.03 and R1.05, identical) has the change-log line `PCL Aug-19 e12150 Refactor to support MS-SQL/ODBC, remove ITM history support`. An `ITEM_HISTORY` record (all fields, quoted filter, ISS-057) on the user's R1.05 system never created its table; it was disabled and then deleted, so whether ITEM_HISTORY works with a correct filter is **not tested**. | open | Treat ITEM_HISTORY exposure as unsupported and use `ITEM_VALUES` with `AGG_INTERVAL`. To close: on an R1.05 system, create an `ITEM_HISTORY` record with an unquoted filter and check whether `DBCSND` stays up and the table is created. | `.claude/skills/data-access/tasks/rdbms-exposure.md`; `knowledge/manuals/IM36K10G10-01EN.md`; `knowledge/manuals/IM36K10L45-01EN.md` §8 |
 | ISS-059 | 2026-10-02 | DATA EXPOSURE (authentication) | IM 36K10G10 §10.2 says to add the `CIX_PROCESS` account to SQL Server as a Windows user (db_owner) in a domain. The CI Service runs as the **local** `.\CIX_PROCESS` (also on the user's domain-joined R1.05 CI Server), which a SQL Server on another host cannot authenticate. | closed | Closed 2026-10-02 (confirmed by user): use a SQL login with db_owner on the target database; SQL Server set to mixed mode (needs a SQL Server restart). Windows authentication only if the SQL host knows the account (not tested). Tested in R1.05 only. | `.claude/skills/data-access/tasks/rdbms-exposure.md` (done); `knowledge/manuals/IM36K10G10-01EN.md` (done) |
 | ISS-060 | 2026-10-02 | DATA EXPOSURE (rows of steady items) | IM 36K10G10 ch. 10 says `ITEM_VALUES` is exposed once per interval, with the aggregation time as timestamp when the item did not change. In one snapshot on R1.05 (1-minute interval), changing items had rows at 02:13:23 while steady items (`VALUE_COUNT` 1) were still at 02:12:24. Whether steady items get a row every interval (maybe written later) or only after an update is not known. | open | Count rows per item over one hour (`SELECT NAME, COUNT(*) … WHERE [TIMESTAMP] > … GROUP BY NAME`) and compare steady with changing items. Until then the task says: take a steady item's last row at or before T. | `.claude/skills/data-access/tasks/rdbms-exposure.md` |
-| ISS-061 | 2026-10-02 | INSTALLATION (folder permissions) | On the user's R1.05 system installed in `C:\Yokogawa\CIServer` (outside Program Files) `tls\sup` and `dbc.sup` inherit **Authenticated Users: Modify** (plus Users: Read): any signed-in user can read the SQL password in `dbc.sup` and change setup files. On the R1.03 development machine (Program Files) `tls\sup` gives Users: ReadAndExecute (read still possible, no write). | closed | Closed 2026-10-02 (user decision: shared internal dev/demo server, left as is). Option if needed, not applied or tested: `icacls <dbc.sup> /inheritance:r /grant:r "SYSTEM:(F)" "Administrators:(F)" "CIX_PROCESS:(R)"`; folder rights in general are set by the IT Security Tool. | `.claude/skills/installation-security/tasks/setup-check.md` (done); `.claude/skills/data-access/tasks/rdbms-exposure.md` (done) |
+| ISS-061 | 2026-10-02 | INSTALLATION (folder permissions) | On the user's R1.05 system installed in `C:\Yokogawa\CIServer` (outside Program Files) `tls\sup` and `dbc.sup` inherit **Authenticated Users: Modify** (plus Users: Read): any signed-in user can read the SQL password in `dbc.sup` and change setup files. On the R1.03 development machine (Program Files) `tls\sup` gives Users: ReadAndExecute (read still possible, no write). | closed | R1.05 (2026-10-08): confirmed again on the R1.05 test server (`icacls`: Authenticated Users:(M) inherited on the install folder and `tls\sup`). Closed 2026-10-02 (user decision: shared internal dev/demo server, left as is). Option if needed, not applied or tested: `icacls <dbc.sup> /inheritance:r /grant:r "SYSTEM:(F)" "Administrators:(F)" "CIX_PROCESS:(R)"`; folder rights in general are set by the IT Security Tool. | `.claude/skills/installation-security/tasks/setup-check.md` (done); `.claude/skills/data-access/tasks/rdbms-exposure.md` (done) |
 | ISS-062 | 2026-10-02 | GRAPHICS (layouts) | `Layouts.readme` lists the menu/toolbar command `help`, but in R1.03 the Operator Interface fails with *Failed to execute menu command 'help'*, *Unrecognized keyword* (`MNUCMD`, `IllegalArgumentException`). The factory layouts do not use it. | open | Software is the reference: documented as not supported. Close when the user confirms. | `.claude/skills/graphics/tasks/layouts.md` §6 (done) |
 | ISS-063 | 2026-10-02 | GRAPHICS (layouts) | The readme does not say that menu items with the commands `toolbar`, `statusline` and `playback record` must be `type="check"`. With a normal item the Operator Interface does not start (*INITFAILED*, `JMenuItem cannot be cast to JCheckBoxMenuItem` in `MenuToolbarOption.checkState`); the web client just drops check items. | open | Rule added to the task. Close when the user confirms. | `.claude/skills/graphics/tasks/layouts.md` §6 (done) |
 | ISS-064 | 2026-10-02 | GRAPHICS (layouts) | Readme: `rows`/`cols` `n*` values share the remaining space by fraction (as HTML frames). Observed: the desktop ignores the fractions (`2*,1*` gave 800:88 px, sizes follow the displays); the web client turns every `n*` into its single *main* panel, so two `n*` overwrite each other. | open | Use one `n*` per frame set, all other divisions in pixels or `fitDisplay`. Close when the user confirms. | `.claude/skills/graphics/tasks/layouts.md` §6 (done) |
@ -95,3 +95,18 @@ development system (see "Test system" in `progress.md`); they do not exist on ot
 | ISS-073 | 2026-10-06 | DSS (remove group / DSSSDA) | Removing an authorization group while a session of one of its users is open fails with *DSSP-E-NODEL … in dataset USER_VAL*; after logging out the session was still referenced, and a retry stopped the process `DSSSDA03` (*DUR-F-BAD_SIZE, Negative size not allowed*; `DUR-W-REM_PROC … exited unexpectedly`); following DSS requests failed with *DUR-F-UNKNOWN_ATT … DSSSDA03* until CI Server was restarted (2026-10-06). After the restart the group was removed without error. `USER_VAL` exports only its header, so open sessions cannot be listed. | open | Workaround: log out the user's sessions and restart CI Server before removing the group; noted in the sample `remove.cmd` / README and `users-groups.md`. Not repeated on purpose (it stops a CI Server process). Report to Yokogawa. | `.claude/skills/authorization/tasks/users-groups.md` (done); `examples/CI-Eng-Sample/remove.cmd`, `README.md` (done) |
 | ISS-074 | 2026-10-06 | GRAPHICS (HTML display login) | IM 36K10R30 §4 lists the user profile fields used by the HTML display login as "… initial display, locale (layout not)". On R1.03.00 the profile's *Layout* is used too: a logon as `CIENG` (layout `CIENG_Operator`) at `/mobileoperator/` without `?l=` opened `CIENG_Operator` (2026-10-02 with ADMIN, 2026-10-06 with `CIENG`). | open | Installed software is the reference; R30 summary and `layouts.md` §3 updated. Close when the user confirms. | `knowledge/manuals/IM36K10R30-01EN.md` (done); `.claude/skills/graphics/tasks/layouts.md` §3, §5 (done) |
 | ISS-075 | 2026-10-06 | GRAPHICS (`jwuiutl -v`) | `deploy-displays.md` called `jwuiutl -v` "report only", but `jwuiutl -d -v -i -l <log> <display>` re-saves the validated display (normalised XML: defaults dropped, positions as attributes; 9 618 → 11 191 bytes for `CIENG_Test`, 2026-10-06). On 2026-10-02 a validation of eight displays hung on one and left `<name>.lck` and `<name>.xml.tmp`; not reproduced on 2026-10-06. | open | Documented in `deploy-displays.md` §2 and the C50 summary. Close when the user confirms. | `.claude/skills/graphics/tasks/deploy-displays.md` §2 (done); `knowledge/manuals/IM36K10C50-01EN.md` (done) |
 | ISS-076 | 2026-10-08 | EQUIPMENT (IEC 104 naming, R1.05) | IM 36K10L41 5th ed. §3.31.1–3.31.2 still calls the IEC 104 manager `eqp104` / `eqp104.sup` and says its name starts with "eqp". R1.05 installs `eqt104.exe` (no `eqp104.exe`), template `eta104_eqt.sup`, and `IEC104_LINE_DF.EQUIPMENT_MAN` defaults to `EQT104` (R1.05 test server, read-only). App. 1.3 gives upgrade steps for IEC 61850 only. Unknown whether an R1.03 IEC 104 line needs the same renaming after an upgrade. | open | Installed software is the reference; summaries use `EQT104`. Needs an upgrade test or a Yokogawa answer. | `knowledge/manuals/IM36K10L41-01EN.md` §1–2, §3.28–3.31 row (done); `.claude/skills/equipment/SKILL.md` (done) |
 | ISS-077 | 2026-10-08 | EQUIPMENT (IEC 104 setup file, R1.05) | The installed template `eta104_eqt.sup` has a keyword `quality_code_parsing = Y\|N` (default N) that moves IEC 104 cause of transmission and quality flags into the item quality field instead of the item status. The 5th ed. manual does not describe it. | open | Behaviour not tested (no IEC 104 device). | `knowledge/manuals/IM36K10L41-01EN.md` §3.28–3.31 row (done) |
 | ISS-078 | 2026-10-08 | EQUIPMENT (EQT utilities, R1.05) | IM 36K10L40 4th ed. describes only `eqpfrcscn`, `eqpiostat` and `eqpdbg` (and still lists IEC 61850, I/O type 1636, under `eqpfrcscn`). R1.05 installs `eqtdbg` (same menu, default process `EQT`), `eqtfrcscn` (template `eqtfrcscn.tpl`) and `eqtiostat` (start line commented out in `equipment_start.cmd`). None is in the manual. | open | Documented from installed files only; `eqtdbg`/`eqtfrcscn` not run (shared server, no EQT line). | `knowledge/manuals/IM36K10L40-01EN.md` §1–3, installed section (done); `.claude/skills/equipment/SKILL.md` (done) |
 | ISS-079 | 2026-10-08 | EQUIPMENT (IEC 61850 client name) | IM 36K10L41 5th ed. §3.32 tells the user to give the IED engineer the client name "EQP850", while §3.32.1 and App. 1.3 use `EQT850`, the process name R1.05 actually uses. | open | Presumably `EQT850`; low priority. | `knowledge/manuals/IM36K10L41-01EN.md` §3.32 (done) |
 | ISS-080 | 2026-10-08 | ACCESS (OPC UA client status item, R1.05) | IM 36K10E20 4th ed. §2.1.2 lists integer states 0–5 for the station `STATUS_ITEM` (0 preparing, 1 connected, 2 communication error and reconnecting, 3 connect attempt failed, 4 server shutdown received, 5 connection recreated); IM 36K10L45 5th ed. §10.9.2 still calls it a Boolean. On R1.03 a Boolean item with 1 = connected was verified. | open | Re-test on an R1.05 system with an Integer status item (not on the shared R1.05 test server without approval). | `.claude/skills/data-access/tasks/opcua-client.md` §2; `knowledge/manuals/IM36K10E20-01EN.md` |
 | ISS-081 | 2026-10-08 | ACCESS (OPC UA server `ServerConfig.xml`, R1.05) | IM 36K10L45 5th ed. §11.7 places `ServerConfig.xml` in `%TLS_ROOT_PATH%\tls\exe`; on the R1.05 test server it exists only in `%TLS_SAV_PATH%` (IM 36K10E20 4th ed. §3.4 agrees). On R1.03 it was in `tls\exe`. The R1.05 file only adds SDK blocks (roles, user password management, PubSub settings, thread pools). | closed | Installed software is the reference (standing user decision). Close when the user confirms. | `.claude/skills/data-access/tasks/access-checks.md`; `knowledge/manuals/IM36K10L45-01EN.md`; `knowledge/manuals/IM36K10E20-01EN.md` |
 | ISS-082 | 2026-10-08 | ACCESS (OPC UA server keywords, R1.05) | The manual names the switch that keeps the native model visible next to an imported information model `OPXUAS_ENABLE_NATIVE_MODEL_TREE`; the installed `opxuas.sup` has `OPXUAS_ENABLE_OWN_MODEL_TREE`. The installed file also has a hidden `OPXUAS_METHOD_TIMEOUT_MARGIN` (10000 ms) that the manual does not describe. | closed | Installed software is the reference (standing user decision). Close when the user confirms. | `knowledge/manuals/IM36K10L45-01EN.md` |
 | ISS-083 | 2026-10-08 | ACCESS (OPC UA client setup defaults, R1.05) | IM 36K10L45 5th ed. §10.11 gives `OPXC_SERVICE_CALL_TIME_OUT` default 10 s; the installed template `epauac_eqp.sup` has 60 s. The template also has `OPXC_DISABLE_SAV_FILE`, `OPXC_ALARM_TIME_ATTRIBUTE` and a hidden `OPXC_CERT_EXP_PERIOD_WARN` (2 months) that the manual does not describe. The installed `opxuac_mon.sup` was not updated (still 10 s, none of the new keywords). | open | Installed software is the reference. Open question: whether per-process files created on R1.03 should get the new keywords after an upgrade. | `knowledge/manuals/IM36K10L45-01EN.md`; `.claude/skills/data-access/tasks/access-checks.md` |
 | ISS-084 | 2026-10-08 | ACCESS (OPC UA client fallback setup file) | The R1.03 manual (and the R1.03 summary) named the fallback client setup file `opxuac.sup`, which exists on neither version. The R1.05 manual (IM 36K10L45 5th ed. §10.11) names `epauac_eqp.sup`, which matches both installations. | closed | Answered by the R1.05 manual and the installed files. Close when the user confirms. | `knowledge/manuals/IM36K10L45-01EN.md` |
 | ISS-085 | 2026-10-08 | ACCESS (OPC A&E server, R1.05) | The installed `opxsys.sup` has a new keyword `OPXAES_DIR_ALM = YES` (A&E server "direct" alarm events) that IM 36K10L45 5th ed. does not describe. | open | Behaviour not tested (OPC A&E loopback is not allowed). | `knowledge/manuals/IM36K10L45-01EN.md`; `.claude/skills/data-access/tasks/access-checks.md` |
 | ISS-086 | 2026-10-08 | INSTALLATION (upgrade merge, R1.05) | IM 36K01C10 5th ed. §2.1.5, §3.3.8, §3.3.15 write the upgrade backup, `jupgutl`, `jmrgconfig.properties` and log paths as `C:\Program Files (x86)\…` and `C:\Users\Public\…`. On the R1.05 test server (installed in `C:\Yokogawa\CIServer`) they are `%TLS_ROOT_PATH%\tls\upg`, `%TLS_ROOT_PATH%\tls\com\jupgutl.cmd`, `%TLS_WAP_PATH%\cfg\properties\jmrgconfig.properties` and `%TLS_SAV_PATH%\jmrg\ref-data`. The text says `-c` takes the properties file, but the examples pass the `properties` folder. | open | Paths written with `%TLS_*%`. The `-c` argument needs a test on a non-shared machine (no upgrade was done on the R1.05 test server). | `knowledge/manuals/IM36K01C10-01EN.md`; `.claude/skills/installation-security/SKILL.md` |
 | ISS-087 | 2026-10-08 | SECURITY (RESTful API ports, R1.05) | The RESTful API server `jrstsrv` listens on TCP 34597 (documented, `JRST_NETWORK_PORT`) and also on TCP 7073 on all addresses. 7073 is not in the Security Guide port table (IM 36K01C30 5th ed. §3.2) or in `jrstsrv.sup`. | open | Do not open 7073 in the firewall unless a need is found. Find out what it is (Yokogawa question). | `knowledge/manuals/IM36K01C30-01EN.md`; `.claude/skills/installation-security/tasks/setup-check.md` |
 | ISS-088 | 2026-10-08 | WINDOWS (WMIC) | IM 36K01C10 5th ed. App. 1.3 still uses `wmic qfe list full`, but WMIC is not installed on Windows Server 2025 / 24H2 (missing on the R1.05 test server). `Get-HotFix` works there. | closed | Use `Get-HotFix`. Close when the user confirms. | `knowledge/manuals/IM36K01C10-01EN.md`; `tools/setup_check.ps1` |
 | ISS-089 | 2026-10-08 | INSTALLATION (local groups, R1.05) | On the R1.05 test server (no dual-redundant platform, no IT Security Tool) the local group `RDC_GA_CLIENT` exists with member `CIX_PROCESS`. The Security Guide mentions this group only for the dual-redundant platform (IM 36K01C30 5th ed. §4.9). | closed | Information only: apparently created by the installer; no action. Close when the user confirms. | `knowledge/manuals/IM36K01C30-01EN.md` |
 | ISS-090 | 2026-10-08 | DOCS (CI Server + PRM) | IM 36K01C10 5th ed. §4.1.1 requires PRM R4.06 or later in a note but R4.08 or later in Table 4.1.1-1 (integration code 1901-0302-03-01). | open | Use R4.08 until clarified (from docs; no PRM available). | `knowledge/manuals/IM36K01C10-01EN.md` |
--- a/knowledge/manuals/IM36K01A50-01EN.md
+++ b/knowledge/manuals/IM36K01A50-01EN.md
@ -1,15 +1,17 @@
 ---
 manual: IM 36K01A50-01EN
 title: CI Server Release Information
-edition: 3rd Edition, Sep. 2023
+edition: 5th Edition, Feb. 2026 (section "Platform and installation"); other sections still from the 3rd Edition, Sep. 2023
-version: R1.03
+version: R1.05 (first written for R1.03); only "Platform and installation" re-checked so far
-status: from docs
+status: from docs ("Platform and installation" compared with the 5th edition on 2026-10-08; Start-menu folder checked on the R1.05 test server)
 ---
-# Release Information: known issues and cautions (R1.03)
+# Release Information: known issues and cautions (R1.05)
 Known limitations and workarounds that the other manuals do not cover. Check this list
-before recommending a workflow in any area. Section numbers refer to the manual.
+before recommending a workflow in any area. Section numbers refer to the manual. The
 "Platform and installation" table follows the 5th edition (R1.05); the other sections were
 written from the 3rd edition (R1.03) and are re-checked with their skills.
 ## Platform and installation
@ -19,10 +21,12 @@ before recommending a workflow in any area. Section numbers refer to the manual.
 | Dual-redundant platform (1.1) | After both computers restart, the former standby may come up as *Guest OS (Isolated)*. | In the Redundancy Management Tool set Next Status to *Standby*, then restart that computer. |
 | IT Security tool (1.3) | Remote Desktop to the CI Server may fail after applying IT Security if OS patch levels differ. | Patch both the server and the RDP client to the latest level. |
 | IT Security tool (1.3) | Changing Windows region/language after applying IT Security causes problems. | Set region and language **before** applying IT Security; never change afterwards. |
-| Windows (1.4) | Windows Server 2016 start menu may not refresh after install. | Restart after installing CI Server. |
+| IT Security tool (1.3, R1.04+) | Upgrading from R1.03 or earlier where the IT security defaults were changed: a dialog offers to reset the account lockout settings (threshold, counter reset, duration). | Answer Yes (No returns to the start of the IT security setup); afterwards set any custom lockout values again. |
-| Windows (1.4) | CI Server started from the command line on Win10 / Server 2016 needs elevation. | Always use *Run as administrator*. |
+| Windows (1.4) | CI Server started from the command line on Win10 / Win11 needs elevation. (The R1.03 Server 2016 start-menu note is gone.) | Always use *Run as administrator*. |
 | Windows (1.4) | Custom fonts can cause visual glitches in the Engineering and Edit modules. | Avoid custom fonts. |
-| Install path (1.9) | The MELSEC EZSocket installer fails if CI Server is in a non-default path that contains spaces. | Non-default install paths must have no spaces. |
+| Windows (1.4, R1.04+) | After a user without rights to the CI Server programs opens the CI Server Start-menu folder, its icons stay blank for everyone. | In an elevated prompt, in `C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CI Server` (likewise *CI Server Remote Connect*, *YOKOGAWA Security*, *YOKOGAWA Redundancy*) run `COPY /B * +,,` to touch the shortcuts. The manual's path has typos; the folder name was checked on the R1.05 test server (2026-10-08). |
 | Install path (1.9) | The MELSEC EZSocket installer fails if CI Server is in a non-default path that contains spaces (still in the 5th edition). | Non-default install paths must have no spaces. |
 | MELSEC (1.9, R1.05) | iQ-R support now uses EZSocket 5.9, installed from `<ISO drive>\Windows\EZSocketPcRedistributableInstaller` (`RunInstaller` as administrator); Mitsubishi reports a vulnerability in it. | Uninstall older EZSocket first. Keep the EZSocket folder writable by Administrators only, run antivirus, keep the PC off untrusted networks (VPN/firewall for remote access), open no untrusted files or links. |
 | Virtual machines (1.19) | Live migration, failover and shared-storage path switching lose acquired data/alarms; failover during engineering can corrupt the engineering data. | Migrate only when no engineering is in progress; keep engineering backups. |
 | Virtual machines (1.19) | Serial-only drivers (Siemens 3964R, telemetry integration), Siemens SAPI-S7 and MELSEC are unavailable on VMs; many other drivers work over TCP/IP only. | Check driver support before choosing a VM. |
 | Virtual machines (1.19) | Do not use VM replication; do not mix physical and virtual machines in HAC; only thin clients may RDP into a virtual CI Server. | Design accordingly. |
@ -31,7 +35,7 @@ before recommending a workflow in any area. Section numbers refer to the manual.
 ## Services
 **ACCESS (1.5)**
- OPC classic on Win10 / Server 2016 / 2019 needs .NET 3.5. Install it from the Windows medium
+- OPC classic on Win10 / Win11 / Server 2019 / 2022 needs .NET 3.5 (5th edition; R1.03 listed Server 2016). Install it from the Windows medium
  (`DISM /Online /Enable-Feature /FeatureName:NetFx3 /All /LimitAccess /Source:<drive>:\sources\sxs`),
  then re-run the OPC Core Components Redistributable in `%TLS_EXE_PATH%`.
 - OPC AE: items in the tree root (no section) appear as `.NAME` and some clients can't use them
@ -50,12 +54,14 @@ before recommending a workflow in any area. Section numbers refer to the manual.
  application appearing. Expected behavior.
 **EQUIPMENT (1.9)**
- MELSEC iQ-R needs Mitsubishi EZSocket 4.4: uninstall older EZSocket first, then run
+- MELSEC iQ-R: R1.03 needed Mitsubishi EZSocket 4.4 from `%TLS_ROOT_PATH%\tls\exe\EZSocketPcRedistributableInstaller`;
-  `RunInstaller` (as administrator) from `%TLS_ROOT_PATH%\tls\exe\EZSocketPcRedistributableInstaller`.
+  R1.05 uses EZSocket 5.9 from the install media (see the MELSEC row in the table above).
  Uninstall older EZSocket first and run `RunInstaller` as administrator.
 - IEC 61850: add the line, then the station (General tab: device IP; Options tab: domain prefix
  and report object), then points. The element address is `<domain prefix><rest>`; the point
  I/O address is only the part **after** the prefix (the prefix is added automatically).
-  Wrong delimiting means no reports/elements are created.
+  Wrong delimiting means no reports/elements are created. (R1.03 edition; this precaution was
  removed in the 5th edition, see the L41 summary §3.32 for R1.05.)
 **PROCESS (1.10)**
 - Java classes that access datasets must get the DSS session with `getDssSession()` (never
--- a/knowledge/manuals/IM36K01C10-01EN.md
+++ b/knowledge/manuals/IM36K01C10-01EN.md
@ -1,27 +1,37 @@
 ---
 manual: IM 36K01C10-01EN
 title: CI Server Setup
-edition: 3rd Edition, Sep. 2023
+edition: 5th Edition, Feb. 2026
-version: R1.03
+version: R1.05 (first written for R1.03, 3rd Edition, Sep. 2023)
-status: from docs (Windows settings checked read-only on the test system with tools/setup_check.ps1)
+status: from docs (Windows settings, services, ports and upgrade-merge files checked read-only on the R1.03 test system and the R1.05 test server, 2026-10-08; IT security not verifiable on the R1.05 test server)
 ---
-# CI Server Setup (R1.03)
+# CI Server Setup (R1.05)
-New installation, maintenance (start/stop, reinstall, upgrade, licence, uninstall) and network
+New installation, maintenance (start/stop, reinstall, upgrade, licence, uninstall), network
-tools. Section numbers refer to the manual.
+tools and, new in R1.05, connection to other Yokogawa products (PRM). Section numbers refer to
 the 5th edition. The manual prints the default paths (`C:\Program Files (x86)\Yokogawa\CIServer`,
 `C:\Users\Public\Yokogawa\tls`); on a machine installed elsewhere use the `TLS_*` variables
 (ISS-086).
 ## 1. Before you start
- Needed: the CI Server software medium (or its ISO) and one **Activated License File per
+- Needed: the CI Server ISO file and one **Activated License File per server** (an upgrade
-  server** (an upgrade needs one that includes the Upgrade License).
+  needs one that includes the Upgrade License).
- Supported OS for R1.03: Windows 10 Pro / Enterprise (64-bit), Windows 10 Enterprise and IoT
+- Supported OS for R1.05 (§1.3.2), all 64-bit: Windows 10 Enterprise / IoT Enterprise LTSC
-  Enterprise 2016 LTSB and 2019 LTSC, Windows Server 2016, Windows Server 2019, Windows Server
+  2019 and 2021; Windows 11 Pro and Enterprise; Windows 11 Enterprise / IoT Enterprise LTSC
-  IoT 2019. On **Windows 10 Pro/Enterprise (non-LTSB/LTSC) the Vnet/IP drivers and the IT
+  2024; Windows Server 2019 / IoT 2019, 2022 / IoT 2022 and 2025 / IoT 2025 (Standard).
-  Security Tool are not supported**. VMs run Windows Server 2019.
+  - On **Windows 11 Pro/Enterprise and Server 2025 the Vnet/IP drivers and the IT Security
- Only listed software may coexist: Chrome / Firefox / Edge 112, Microsoft Office 2016/2019/365
+    Tool are not supported**; the other OSs also allow CI Server and PRM on one computer.
-  (Excel Add-in), PI AF SDK 2.10.5 + .NET 4.6.2, Adobe Acrobat (Reader) DC, Yokogawa standard
+  - Gone since R1.03: Windows 10 Pro/Enterprise (non-LTSC), LTSB 2016, Server 2016. The R1.03
-  antivirus, Standard Whitelisting Software for Endpoint Security. Anything else may disturb CI Server.
+    rule "VMs run Windows Server 2019" is no longer in the manual.
  - Verified (R1.05 test server, 2026-10-08): CI Server R1.05 runs on Windows Server 2025
    Datacenter, an edition the list does not name.
 - Only listed software may coexist (§1.3.3): Chrome 130, Firefox 131, Edge 130; Microsoft
  Office 2024 / Microsoft 365 (Excel Add-in); PI AF SDK 2.10.5 + .NET 4.6.2; Python 3.12
  (pyTOOLS); SimbaClient ODBC driver 10.2; Adobe Acrobat / Acrobat Reader DC; Yokogawa standard
  antivirus; Standard Whitelisting Software for Endpoint Security (not on Windows 11 Pro or
  Server 2025; ask Yokogawa before using it on VMs). Anything else may disturb CI Server.
 ## 2. New setup
@ -33,13 +43,16 @@ tools. Section numbers refer to the manual.
   Windows network settings.
 4. Install CI Server (with or without the IT Security Tool).
 5. Apply IT security settings (IT Security Tool; Domain Link Management Tool for linked domain).
   Use the same security model as the Yokogawa products it connects to or shares the PC with.
 6. Apply the CI Server licence.
 On a VM (§2.2): mount the ISO, Windows settings, (Vnet/IP) **Vnet/IP Interface Package**
 instead of drivers/card, VM network settings, install, IT security, licence, then VM
 settings (auto start/shutdown with host, allow RDP from thin clients, disable NetBIOS over
 TCP/IP, network metrics favouring the plant network). On VMs, adapters not used for Vnet/IP
-must not use 192.168.0.0/16. Dual-redundant platform: see §2.3 and IM 30A05C30.
+must not use 192.168.0.0/16. The Vnet/IP Interface Package works only with IT security
 applied. Mounting the ISO from Hyper-V Manager needs a Server 2019 or 2022 Datacenter host
 with the Hyper-V role (§2.2.1). Dual-redundant platform: see §2.3 and IM 30A05C30.
 ### Windows settings (§2.1.2)
@ -49,23 +62,32 @@ must not use 192.168.0.0/16. Dual-redundant platform: see §2.3 and IM 30A05C30.
 | Visual effects | *Let Windows choose what's best* |
 | Processor scheduling | *Programs* |
 | Virtual memory | Custom size, initial = maximum = 1.5 × RAM (e.g. 6 GB RAM → 9216 MB); restart |
-| Power | *High performance*; disk, sleep, hibernate, display: never; hybrid sleep off; wake timers off; power button = shut down |
+| Power | *High performance*; disk, sleep, hibernate, display: never; hybrid sleep off; wake timers off; adaptive brightness off; power button = shut down |
-| Fast startup | Off: run `<DVD>\Windows\Tool\HiberbootDisabled.bat` as administrator (`HiberbootEnabled` = 0); required before Vnet/IP drivers on Win10 |
+| Fast startup | Off: run `<ISO drive>\Windows\Tool\HiberbootDisabled.bat` as administrator (`HiberbootEnabled` = 0); required before Vnet/IP drivers on Win10 |
-| Windows Defender | Turned off by group policy (Server 2016: *Turn off Windows Defender*; 2019: *Turn off Windows Defender Antivirus*) |
+| Microsoft Defender Antivirus | Turned off by group policy *Turn off Microsoft Defender Antivirus*. Exceptions: on Windows 11 Pro 24H2 keep it on; on Win10 LTSC 2021 and Win11 LTSC 2024 it cannot be turned off |
 | Automatic Windows updates | Disabled by group policy (*Configure Automatic Updates* = Disabled). With WSUS: install CI Server first, then disable from WSUS |
 | Drive optimization | Scheduled optimization off |
 | Automatic cleanup | Task Scheduler › Microsoft › Windows › Servicing › `StartComponentCleanup` disabled |
-| Windows updates | KB5023702 (2023-03) on Win10 2019 LTSC / Server 2019, or folder permissions may be wrong |
+| Windows updates | Apply the per-OS list of cumulative OS and .NET updates in §2.1.2 (state of Feb. 2026; Yokogawa's Endpoint Security Service has the current list), or some install-folder rights may be wrong. Replaces the single R1.03 update KB5023702 |
-| .NET Framework 3.5.1 | Installed (`dism /online /enable-feature /featurename:NetFX3 /all /Source:<DVD>:\sources\sxs /limitaccess`, or Server Manager feature) |
+| .NET Framework 3.5.1 | Installed on all listed OSs (`dism /online /enable-feature /featurename:NetFX3 /all /Source:<drive>:\sources\sxs /limitaccess` from the Windows medium, or the Server Manager feature) |
-| DCOM | Default Authentication Level = *Connect*; restart |
+| DCOM | Default Authentication Level = *Connect* (needed for OPC Classic on a CI Core); restart |
 | Display | Scale 100 % |
 | 8dot3 names | `fsutil behavior set disable8dot3 2`; restart |
 | Japanese keyboards (new) | On Win10 LTSC 2021 / Win11 LTSC 2024 switch to the previous Microsoft IME version |
 Verified (R1.05 test server, 2026-10-08): a server can run CI Server with several of these
 not applied (Defender on, updates and cleanup not disabled, no .NET 3.5); the manual still
 requires them for operation.
 ### Vnet/IP (§2.1.1, §2.1.3, §2.1.4)
 - Card DIP switches: domain 1–16, station 1–64 (start from 64 downwards), each with odd
  parity; action-mode switch all OFF. One card per computer; card before drivers.
- Drivers from `<DVD>\Windows\VnetVirtualProduct\VirtualProduct_CIServer_package*.zip` →
+- Which drivers: Vnet/IP and Ethernet on the same computer → control bus driver only (no open
  communication driver); Vnet/IP only → both; no Vnet/IP → neither.
 - Before the open communication driver on Win10 LTSC 2019, Server 2019 or Server 2022, check
  in `msinfo32` that **Kernel DMA Protection** is Off (switch it off in the BIOS if needed).
 - Drivers from `<ISO drive>\Windows\VnetVirtualProduct\VirtualProduct_CIServer_package*.zip` →
  `installVirtProd.cmd` (VM: `installVirtProdVPF.cmd`), as administrator, antivirus off.
 - Rename connections: *Ethernet*, *Vnet*, *VnetIPOpen* (VM: *VnetIPBUS1*, *VnetIPBUS2*,
  *RemoteUINetwork*). Disable IPv6; Vnet uses only *Yokogawa Vnet Protocol* + IPv4.
@ -73,7 +95,7 @@ must not use 192.168.0.0/16. Dual-redundant platform: see §2.3 and IM 30A05C30.
  Vnet/IP open `192.168.<128+domain>.<129+station>`/24; VM remote UI `172.18.<domain>.<station>`/16.
 - Computer name = station name. Check `sc query VLTDI` = RUNNING.
 - Never use Internet Connection Sharing, bridge connections or Homegroup.
- Run the TCP/IP Inconsistency Detect Tool before installing CI Server (§3.8).
+- Run the TCP/IP Inconsistency Detect Tool before installing CI Server (§3.9).
 ### Installing CI Server (§2.1.5)
@ -81,79 +103,185 @@ must not use 192.168.0.0/16. Dual-redundant platform: see §2.3 and IM 30A05C30.
  join the domain first for domain/combination management.
 - Close applications, disable antivirus, never run two installers, never install where CI
  Server Remote Connect is installed.
- `<DVD>\Windows\CIServer\ciserver-R<ver>-r<build>M-setup.exe` = CI Server only;
+- `<ISO drive>\Windows\CIServer\ciserver-R<ver>-r<build>M-setup.exe` = CI Server only;
  `…-ITSecurity.exe` = CI Server + IT Security Tool (also installs VAGW modules; install type
  *CI Server and IT Security Tool*). Choose the install folder (no spaces if non-default,
-  see known issues), reboot.
+  see known issues). An upgrade keeps the first install folder.
 - Upgrade to R1.05 or later: the installer offers *Automatic upgrade CI Server configuration*
  (ticked by default). See §3.
 - At the end: tick *I want to set up IT Security Tool Now* for IT security 2.0, untick it
  for 3.0 (below); then reboot.
 - **Change the initial passwords of the predefined CI Server user accounts** (Engineering
  Module manual).
-### IT security (§2.1.6) and licence (§2.1.7)
+### IT security (§2.1.6)
- IT Security Tool: select *Standard Model* and the user management type; keep default items;
+The IT Security Tool now offers **IT security version 2.0 or 3.0**. A full list of the 3.0
-  restart. The model must be the same across the system. Save/export settings if you change
+settings comes as a PDF with the tool. Common rules:
-  defaults. Running the tool (also during upgrade) overwrites manual security changes.
+- The security model must be the same across the system; linked domain management: apply
- Licence: Start menu › *License Authorization Wizard* (admin) › select the activated licence
+  *Standalone* first, join the domain, then link with the Domain Link Management Tool.
-  file › Finish.
+- Export the settings if you change defaults. Running the tool (also during an upgrade)
  overwrites security changes made by other means.
 **Version 2.0**: at the end of the install keep the checkbox ticked, choose version 2.0,
 *Standard Model*, the user management type, keep default items, restart.
 **Version 3.0** (needs a v3.0 licence number per computer, from the licence certificate):
 1. Unblock the ISO file (file properties) so the script runs properly.
 2. Untick the IT Security checkbox at the end of the install.
 3. As administrator run `<ISO drive>\Windows\CIServer\ITSecurity\Installer\ITSec_3_InstalledSoftwareForCIX.cmd`
   and enter the licence number (up to 20 letters/digits, no hyphens).
 4. Start the IT Security Tool, *Setup*, version 3.0 (Standard model and Standalone are
   preselected), restart.
 - The GPO file `CIX_Standard_3.0.zip` and the settings PDF are placed under
  `C:\ProgramData\Yokogawa\IA\iPCS\Platform\Security\GPOFiles\3.0` and `…\Document\3.0`.
 - CI Mobile View or a domain controller: run `ITSec_3_ForCIViewHTML.cmd` or
  `ITSec_3_DCForCIX.cmd` from the same folder, then `ciserver-…-ITSecurity.exe` with install
  type *Apply IT Security only*, version 3.0, model *CI View standard Model Standalone Management*.
 **Other Yokogawa products on the same PC**: if CI Server is installed after a product that has
 IT security 3.0, CI Server may use 2.0 or 3.0; after a product with 2.0, only 2.0. If the
 other product is installed later, its own supported versions decide (a 2.0-only product
 forces 2.0).
 **LAPS** (Local Administrator Password Solution; only with linked domain management and IT
 security 3.0, after the v3.0 GPO is applied to the clients):
 - Install `<ISO drive>\Windows\ThirdParty\LAPS\LAPS.x64.msi`: on the domain controller only
  the management tools, on the clients only the AdmPwd GPO extension.
 - On the domain controller, as a member of Enterprise Admins and Schema Admins, in an
  elevated PowerShell: `Import-module AdmPwd.PS`, `Update-AdmPwdADSchema`,
  `Set-AdmPwdComputerSelfPermission -OrgUnit "<OU>"`. Then enable the policy (Security Guide
  summary §7).
 - With software restriction policies applied, start the msi from an elevated command prompt.
 ### Licence (§2.1.7)
 Start menu › *License Authorization Wizard* (admin) › select the activated licence file › Finish.
 ### CI Server Remote Connect (§2.4)
 On a CI View PC (never on a Portal or Core): browse to `http(s)://<portal>:<port>` (defaults
 8080 / 8443), *Download (Windows)*, run `CI-rc-setup.exe`. Portal ports are in `jwuiisg.sup`
 (Setup File Editor › *Client communication* tab); open them in the firewalls.
 - Moving Remote Connect to a later *version* means uninstall, then install the new one; a
  later revision of the same version can be installed over it.
 - With software restriction policies applied, switch them off before upgrading Remote Connect
  and on again afterwards.
 - IT security on a Remote Connect PC: run `ciserver-…-ITSecurity.exe` with install type
  *IT Security for multi-product environment*, then version 2.0 (checkbox) or 3.0
  (`ITSec_3_InstalledSoftwareForCIViewRC.cmd`, then the tool).
 ### Virtualization extras (§2.5)
 RD Session Host + RD Licensing (per device) for USB redirection; limit connections to 1;
 allow multiple sessions per user; enable *Windows Audio* and the *System Sound Service* task
-for sound over RDP.
+for sound over RDP. Before applying IT security 3.0 there, set the *Windows Remote Management
 (WS-Management)* service to Automatic and the policy *Allow Remote Shell Access* to Not
 Configured, then restart.
 ## 3. Maintenance
-**Start/stop (§3.1)**: Start menu › CI Server › *Start CI Server* / *Stop CI Server*, or the
+**Start/stop CI Server (§3.1)**: Start menu › CI Server › *Start CI Server* / *Stop CI
-*CI Service* Windows service (set startup type *Automatic* for automatic start). An expired
+Server*, or the *CI Service* Windows service (service name `StartCIServer`; startup type
-licence gives an error at start.
+*Automatic* for automatic start). An expired licence gives an error at start.
-**Reinstall / upgrade (§3.2)**, upgrades from R1.02 or earlier (needs a Product Maintenance
+**Start/stop VAGW Bossd (§3.2, new)**: from R1.04, as a `CIX_MAINTENANCE` administrator in an
-Licence):
+elevated prompt: `%TLS_ROOT_PATH%\tls\vagw\program(x64)\vagwstarter.exe -s` (start) or `-e`
-1. Database consistency: `dsschk`, `dsschk -r`, `dsschk -e`, `dsschk -e -r` (upgrade only).
+(stop); log in `C:\ProgramData\Yokogawa\IA\iPCS\Products\CENTUMVP\UACS\Server\Log`. On R1.03
-2. Stop CI Server; set the CI Service startup type to *Manual*.
+use the Services console. VAGW exists only when installed with the IT Security Tool.
-3. Stop the *VAGW Bossd* service, then back up `%TLS_ALLUSERS_PATH%` and `%TLS_ROOT_PATH%\tls`
+
-   (plus project files).
+**Reinstall / upgrade (§3.3)**: direct upgrade from R1.01 or later; apply the Product
-4. On the Core (upgrade): delete in `%TLS_SAV_PATH%` `eqp*_main.*`, `eqp*_item.*`, `opx*.*`
+Maintenance Licence to the Portal/Core first. If CI Server was installed with the IT Security
 Tool, the reinstall/upgrade must include it too.
 1. (§3.3.1) Note the instance setup files (one per equipment line: equipment process name +
   `.sup`, Engineering Module › Equipment › Lines) and their templates (Setup File Editor ›
   *Templates*, `*_eqp.sup` / `*_eqt.sup`; since R1.04 `eqa850_eqp.sup` is `eta850_eqt.sup`).
 2. Database consistency: `dsschk`, `dsschk -r`, `dsschk -e`, `dsschk -e -r` (upgrade only).
 3. (§3.3.3, Vnet/IP on a VM, from R1.01–R1.03 to R1.04+) Set the device of every Vnet line
   back to `/dev/bk00` in the Engineering Module.
 4. Stop CI Server; set *CI Service* to *Manual*. Stop VAGW Bossd (above) and set it to *Manual*.
 5. Back up `%TLS_ALLUSERS_PATH%` and `%TLS_ROOT_PATH%\tls` (plus project files).
 6. On the Core (upgrade): delete in `%TLS_SAV_PATH%` `eqp*_main.*`, `eqp*_item.*`, `opx*.*`
   (`.sav/.d01/.k01`) and `*.sqlite`.
-5. Note changed setup files (Setup File Editor, *Status* = Changed) and copy
+7. Note changed setup files (Setup File Editor, *Status* = Changed) and copy
-   `tls\com`, `sup`, `tpl`, `src` and `%TLS_ALLUSERS_PATH%\wap`.
+   `tls\com`, `sup`, `tpl`, `src`, `exe\ServerConfig.xml` and `%TLS_ALLUSERS_PATH%\wap`.
-6. (Vnet/IP) Update drivers (uninstall, reinstall, restart) and network settings.
+8. (Vnet/IP) Update drivers (uninstall, reinstall, restart) and network settings.
-7. Install over the top (no uninstall); if IT Security Tool was installed before, install it again.
+9. Install over the top (no uninstall), keeping the automatic merge ticked unless you want to
-8. IT security, licence.
+   merge everything by hand.
-9. Restore: **compare and merge** changes into the new files (never copy old files over new
+10. IT security (version 3.0: run `ITSec_3_InstalledSoftwareForCIX.cmd` first), licence; start
-   ones), including `wap\cfg\operatorInterfaces\DEPLOY\layouts\`; re-apply IT security.
+    CI Server once to confirm, then stop it.
-10. Verify: start, `dsschk -e -r` three times, restart, check `%TLS_LOG_PATH%\ci_start.log`,
+11. Restore (§3.3.14): check the merge report and conflict log (below) and merge by hand what
-    restore the startup type.
+    was not merged. Compare instance setup files with the **new templates** and copy new
- ODBC: if the Simba client version differs, remove DSNs, uninstall and reinstall the client;
+    keywords into each; compare other setup files with the newly installed ones; never copy
-  on R1.02 or older with the Simba server, uninstall the server before upgrading.
+    old files over new ones. Layouts (`wap\cfg\operatorInterfaces\DEPLOY\layouts\`): check
- Passwords of predefined CI Server accounts are reset to the initial ones: change them again.
+    them if merged automatically, merge by hand otherwise. Re-apply IT security.
 12. Verify (§3.3.15): start, `dsschk -e -r` three times, stop, start VAGW Bossd, start,
    check `%TLS_LOG_PATH%\ci_start.log`; from R1.01/R1.02 compile all alarm selection area
    expressions; restore the startup types (VAGW Bossd back to Automatic).
 - Product-specific upgrade notes live elsewhere: ODBC from R1.02 or older (IM 36K10L45
  "Notes for upgrading to R1.03.00"), OPC UA client/server (IM 36K10L45 "Notes for upgrading
  to R1.04.00"), IEC 61850 (IM 36K10L41 App. 1), RGS with EAL from R1.03 (merge the OPC UA
  client setup file, download the project common section and tag list from the ENG HIS).
  The R1.03 Simba client/server reinstall notes are no longer in this manual.
 - Passwords of predefined CI Server accounts are reset to the initial ones: change them
  again (running the IT Security Tool does not reset them).
-**HAC upgrade (§3.3)**: stop standby, disconnect its network, upgrade and test offline, stop
+**Automatic merge of configuration files (R1.05+, §2.1.5, §3.3.8, §3.3.14, §3.3.15)**
-standby, stop primary, reconnect standby and start it, upgrade primary, start it (sync resumes).
+- The installer copies user files to `%TLS_ROOT_PATH%\tls\upg\to-<new>\util\backup\user\tls`
  (`com`, `sup`, and `wap\cfg\operatorInterfaces\DEPLOY\layouts`, `colors`, `chartGroups`)
  and merges them with the new version.
 - Results: `upgrade-report-<old>-to-<new>-<date>.csv` (columns File name, Attribute, Conf
  value, Default old, Default new, Merged value, Reason) and `upgrade-conflicts-…log`, in
  `%TLS_LOG_PATH%\jmrg` (the manual prints the default path).
 - If it did not run: copy the backup `com` and `sup` folders and the three wap folders into
  that `upg` path, then in an elevated prompt in `%TLS_ROOT_PATH%\tls\com` run
  `jupgutl.cmd -o <old version> -n <new version> -p "<tls root>" -c "<…\wap\cfg\properties>"`
  (e.g. `-o 1.04.00 -n 1.05.00`). The text says `-c` is the `jmrgconfig.properties` file but
  the examples pass its folder; not tested (ISS-086).
 - Verified (R1.05 test server, 2026-10-08): `jupgutl.cmd` starts the Java tool in
  `tls\exe\jmrg.jar`; `%TLS_WAP_PATH%\cfg\properties\jmrgconfig.properties` limits the merge
  to `*_start*` / `*_stop*` files in `com`, `*.sup` in `sup` and `*.xml` in the three wap
  folders; reference copies of the shipped files of R1.01.00–R1.04.00 are in
  `%TLS_SAV_PATH%\jmrg\ref-data`. Other files (rest of `com`, `tpl`, `src`,
  `ServerConfig.xml`) still need a manual compare.
-**Extend licence (§3.4)**: License Authorization Wizard while running; node name/number must
+**HAC upgrade (§3.4)**: stop standby, disconnect its network, upgrade and test offline, stop
 standby, stop primary, reconnect standby and start it, upgrade primary, start it (sync
 resumes). Keep one server running if several are upgraded at once.
 **Extend licence (§3.5)**: License Authorization Wizard while running; node name/number must
 match; takes effect within an hour. New features need CI Server stopped first.
-**Uninstall (§3.5, §3.6)**: back up, stop CI Server and VAGW Bossd, Programs and Features ›
+**Uninstall (§3.6, §3.7)**: back up, stop CI Server and VAGW Bossd, Programs and Features ›
 CI Server › Uninstall, restart. Remote Connect: uninstall it, then CI Server (IT Security
-definitions), then run `<DVD>\Windows\CIServer\ITSecurity\DeleteITSecurity.cmd`.
+definitions), then run `<ISO drive>\Windows\CIServer\ITSecurity\DeleteITSecurity.cmd`.
-**TCP/IP tools (§3.8)**: from the VirtualProduct package `XCM3003\Module\Tool`:
+**TCP/IP tools (§3.9)**: from the VirtualProduct package `XCM3003\Module\Tool`:
 `TcpipInconsistencyDetector.cmd` (check) and `TcpipInconsistencyRepair.cmd` (resets all NIC
 IPv4 settings: note them first, re-enter after restart).
 ## 4. Connecting Yokogawa products (new chapter)
 - Each combination has an **integration code**: package code 1 – package code 2 – type –
  revision. Type 01: same PC, no interaction; 02: separate PCs that interact (two type-02
  products never on one PC); 03: same or separate PCs, working together; 04: as 03 with
  limits. When manuals of two products disagree, use the one with the newer revision.
 - Security model and user management type must match on both products.
 - **CI Server + PRM Server** (§4.1.1): code 1901-0302-03-01; CI Server R1.04 or later, PRM
  Server R4.08 or later (a note in the same section says R4.06; ISS-090); Standard model;
  standalone or domain/combination management; the same IT security version on both.
  - PRM first: (if VAGW or Vnet/IP is used) remove the Vnet driver with PRM Disc 1 and install
    the one from the CI Server ISO; run the CI Server + IT Security installer until it
    restarts; stop PRM with `<OS drive>:\PRM\Tool\PRMStop.bat`; finish the install; set
    security; restart (PRM services start by themselves).
  - CI Server first: stop CI Server and VAGW Bossd, set both to Manual, install PRM, restore
    both startup types.
 ## Troubleshooting (Appendix 1)
 | Problem | Workaround |
 |---|---|
 | Server Manager error, Microsoft updates fail (80070543), .NET install fails | Temporarily set DCOM Default Authentication Level to *Connect* (revert to *None* afterwards where the manual says so), restart |
 | Cannot manage users in Control Panel | Use Computer Management › Local Users and Groups |
-| Installed updates not listed | `wmic qfe list full` |
+| Installed updates not listed | Manual: `wmic qfe list full`. WMIC is missing on Windows Server 2025 / 24H2 (verified, R1.05 test server, 2026-10-08): use `Get-HotFix` in PowerShell (ISS-088) |
-| Cannot change time zone (Server 2019 with UAC) | Run `timedate.cpl` as administrator |
+| Cannot change the time zone (Server 2019 with UAC) | Run `timedate.cpl` as administrator |
--- a/knowledge/manuals/IM36K01C30-01EN.md
+++ b/knowledge/manuals/IM36K01C30-01EN.md
@ -1,31 +1,39 @@
 ---
 manual: IM 36K01C30-01EN
 title: CI Server Security Guide
-edition: 3rd Edition, Sep. 2023
+edition: 5th Edition, Feb. 2026
-version: R1.03
+version: R1.05 (first written for R1.03, 3rd Edition, Sep. 2023)
-status: from docs (users/groups and firewall checked read-only on the test system)
+status: from docs (users/groups and firewall checked read-only on the R1.03 test system; listening ports, users and firewall checked read-only on the R1.05 test server, 2026-10-08; the IT Security Tool is not installed there and not supported on its Windows Server 2025, so IT security itself is not verified on R1.05)
 ---
-# CI Server Security Guide (R1.03)
+# CI Server Security Guide (R1.05)
 What the IT Security Tool changes, which Windows accounts and firewall openings CI Server
-needs, and the related utilities. Section numbers refer to the manual.
+needs, and the related utilities. Section numbers refer to the 5th edition. Since R1.04 the
 manual covers Windows Server 2022 instead of 2016; R1.05 adds Windows 11 Enterprise LTSC 2024
 and **IT security version 3.0** (§7 below).
 ## 1. Threats and measures
 - Threats: attacks over the network, direct attacks at a terminal, theft of a computer/data.
 - Measures: access control (files, folders, registry, DCOM/OPC, system commands), personal
-  firewall, stopping unused services, IT environment settings (NetBIOS, disk password), and
+  firewall, stopping unused services, IT environment settings (NetBIOS, disk password,
-  group policies (password/lockout, security options, software restriction, audit policies,
+  Delivery Optimization, Defender), and group policies (password/lockout, security options,
-  administrative templates, safe DLL search order).
+  software restriction, audit policies, administrative templates, safe DLL search order).
 - IT security settings **must** be applied at the area and process levels; business and
  corporate levels follow the site's own policy.
 ## 2. Security model and user management
 - CI Server supports only the **Standard model**: protects against network and terminal
-  attacks, **not** against theft. Password and lockout policies are *not* set by it (use
+  attacks, **not** against theft.
-  domain policy).
+- Password and lockout (§2.1, §3.6.1–3.6.2): in IT security 2.0 the password policy is not
  applied (use domain policy), but the **account lockout policy is applied** (10 failed
  sign-ins, counter reset after 15 min, locked for 15 min). In 3.0 both are settings of the
  tool; for domain accounts set them on the domain controller or in the Default Domain Policy.
  (The R1.03 version of this summary said lockout was not set; that was wrong in R1.03 too.)
 - Upgrading from R1.03 or earlier with changed IT security defaults: a dialog asks to reset
  the lockout values; answer Yes, then set custom values again (IM 36K01A50 §1.3).
 - User management types:
 | Type | Accounts kept on | Notes |
@ -36,7 +44,8 @@ needs, and the related utilities. Section numbers refer to the manual.
 | Linked domain (recommended for new systems) | Domain, linked to local groups | Apply *Standalone* first, join domain, then link with Domain Link Management Tool |
 - Groups/accounts created by the IT Security Tool (standalone: local; domain types: on the
-  domain controller, with `_LCL` local helper groups):
+  domain controller, with `_LCL` local helper groups). **With IT security 3.0 only the
  Standalone and Linked domain sets are created** (§2.2.1).
 | Name | Kind | Purpose |
 |---|---|---|
@ -51,13 +60,21 @@ needs, and the related utilities. Section numbers refer to the manual.
 Use these accounts only for CI Server. Changing the security model may delete or rename groups.
 Verified (R1.05 test server, 2026-10-08): without the IT Security Tool, CI Server still
 creates the local user `CIX_PROCESS` (member of Administrators) and runs *CI Service* with it;
 there are no `CIX_` groups and no `CTM_PROCESS`. A local group `RDC_GA_CLIENT` with member
 `CIX_PROCESS` also exists although the server is not a dual-redundant platform (ISS-089, no
 action needed).
 ## 3. Firewall (§3.2)
-Windows Firewall on; block everything except what CI Server needs:
+Windows Firewall on; block everything except what CI Server needs. IT security 3.0 uses the
 same exception list (§3.7.2).
 | Use | Port |
 |---|---|
 | Web / secure web (CI View, CI Portal) | TCP 8080 / 80, TCP 8443 / 443 |
 | RESTful API web server (`jrstsrv`, new in R1.04/R1.05) | TCP 34597 (`JRST_NETWORK_PORT` in `jrstsrv.sup`) |
 | DURM between nodes | UDP 17001, 17101 (one per DURM line) |
 | SMDMON (system log collection) | UDP 18002 |
 | Remote desktop (only if needed, restrict users) | TCP 3389 |
@ -74,15 +91,26 @@ Windows Firewall on; block everything except what CI Server needs:
 ICMP echo (ping) is allowed by the Standard model.
 Verified (R1.05 test server, 2026-10-08): listening are TCP 8080/8443 (web), 34597 (RESTful
 API), 34493 (OPC UA server `opxuas`), UDP 17001/17101 (DURM) and 18002 (SMDMON). The RESTful
 API server also listens on **TCP 7073** on all interfaces; no manual mentions this port and
 `jrstsrv.sup` has no keyword for it (ISS-087). Do not open it in the firewall.
 ## 4. Other settings (§3.3–§3.6)
- Unused services disabled by the tool (depending on OS): Diagnostic Policy, Connected User
+- Unused services disabled by the tool (OS columns now Win10 LTSC, Win11 LTSC 2024, Server
-  Experiences and Telemetry, dmwappushsvc, Downloaded Maps Manager, IP Helper, Program
+  2019, Server 2022): Diagnostic Policy, Connected User Experiences and Telemetry,
-  Compatibility Assistant, Remote Registry, Shell Hardware Detection, Themes, Windows Push
+  dmwappushsvc, Downloaded Maps Manager, IP Helper, Program Compatibility Assistant, Remote
-  Notifications, and others. DHCP Client must stay running.
+  Registry, Shell Hardware Detection, Themes, Windows Push Notifications, and others.
  Delivery Optimization is no longer stopped; WinHTTP Web Proxy Auto-Discovery left the list.
  DHCP Client must stay running.
 - Delivery Optimization (§3.5.3): limited by policy (Server 2022: HTTP only; other listed OSs:
  bypass) so updates do not spread between plant PCs.
 - Defender (§3.5.4): the "turn off" policy is set on OSs older than Windows 11 and left
  unconfigured on Windows 11; it has no effect on Win10 LTSC 2021 / Win11 LTSC 2024.
 - OPC: *Create permanent shared objects* right for `CIX_OPC`, `CIX_PROCESS`, `CTM_PROCESS`;
  network access sharing model *Classic*; DCOM port range 20500–20550 (the manual's table
-  also prints "2500–20550", taken as a typo).
+  still prints "2500–20550" in R1.05, taken as a typo).
 - NetBIOS over TCP/IP can be disabled (default with domain/combination management); then
  configure HOSTS/DNS for name resolution.
 - USB storage disabled; use the StorageDeviceCTL utility (members of `CIX_MAINTENANCE`) to
@ -92,14 +120,22 @@ ICMP echo (ping) is allowed by the Standard model.
 | Tool | Use |
 |---|---|
-| IT Security Tool (Start › YOKOGAWA Security) | *Setup* (model + management type), *Save*/*Restore* (with a default password for recreated accounts), *Change Password* of the saved file, *Import*/*Export*, *Information* (summary) |
+| IT Security Tool (Start › YOKOGAWA Security) | *Setup* (version 2.0/3.0, model, management type), *Save*/*Restore* (with a default password for recreated accounts), *Change Password* of the saved file, *Import*/*Export*, *Information* (summary) |
 | Domain Link Management Tool | Link/unlink the domain (linked domain management); sign in as local admin + `CIX_MAINTENANCE` |
-| `PrepareReconstruction.cmd` then `ciserver-…-ITSecurity.exe` › *Apply IT Security only* | Re-apply with different target components |
+| `PrepareReconstruction.cmd` then `ciserver-…-ITSecurity.exe` › *Apply IT Security only* | Re-apply with different target components (CI Mobile View, General PC, domain controller) |
-| `Yokogawa.IA.iPCS.Platform.Security.CreateCIXProcess.exe [-p <password>]` (`<DVD>\Windows\CIServer\ITSecurity`) | Create `CIX_PROCESS` or set its password; same password on all collaborating computers; restart |
+| Reapply on Remote Connect after an upgrade to R1.05 | Run the R1.05 `-ITSecurity.exe` installer again to reinstall the IT Security Tool (overwrite install), then apply (§4.8.1) |
 | `ResetITSecCondition.cmd` (`<ISO drive>\Windows\CIServer\ITSecurity`) | First step when switching CI Mobile View, General PC or a domain controller between IT security 2.0 and 3.0 (§4.8.3–4.8.4) |
 | `Yokogawa.IA.iPCS.Platform.Security.CreateCIXProcess.exe [-p <password>]` (`<ISO drive>\Windows\CIServer\ITSecurity`) | Create `CIX_PROCESS` or set its password; same password on all collaborating computers; restart |
 | `…CreateCTMProcess.exe [-p <password>]` | Same for `CTM_PROCESS` |
 | `ITSecuritySettingItemExport.exe` | Export applied settings |
 | `YWVNETCreateVNTUser` | Change passwords of the Vnet/IP Interface Package users (VM) |
 Installer options (App. 2.5): *CI Server and IT Security Tool* for CI Core / CI Portal; *IT
 Security for multi-product environment* for CI View / CI Mobile View on a PC where another
 Yokogawa product's IT security is applied; *Apply IT Security only* for CI Mobile View,
 General PC and domain controller (avoid it where other products are installed). Applying the
 wrong station type means reinstalling Windows. Version 3.0 always needs a licence number.
 **Changing the account that runs CI Server (§4.9)**: create the user, add it to
 Administrators (and `RDC_GA_CLIENT` on a dual-redundant platform; `CIX_OPC` or
 `CIX_OPC_LCL` when IT security is applied), set it on the *CI Service* Log On tab and on the
@ -111,4 +147,49 @@ Extra settings the site may add: audit policies and event log sizes, disable rec
 console and Guest account, restrict audit log and removable media access, immediate
 screen-saver password, SNMP, SSL/TLS registry settings, secure startup and
 `AllowedPaths` registry keys, remove *Everyone* for anonymous users, remove unused
-protocols, block malicious DLL loading.
+protocols, block malicious DLL loading, show a notice on entry to a security zone (§5.26).
 **Safe API use (§5.27, new)**: give each client application of the APIs (ODBC, OPC UA, web,
 RESTful API, …) its own DSS user or authorization group with only the datasets and the
 read/insert/update/delete rights it needs and a unique password; never run it as SYSTEM or
 with an administrator account. The RESTful API is HTTPS only; use the newest TLS version
 (§5.14). Treat exported data as sensitive and delete what is not needed.
 ## 7. IT security version 3.0 (new in R1.05)
 From docs only (§2.1, §3.7, §4.8.3–4.8.4, ch. 6). Installation: Setup summary §2.1.6.
 - Chosen in the IT Security Tool next to 2.0; needs a licence number per computer. The full
  setting list is a PDF installed with the tool. Settings are grouped in categories (Access
  Control, Firewall per profile, System Services, Password Policy, Account Lockout Policy,
  Security Options, Administrative Templates, Removable Storage Access, …); access control,
  firewall exceptions, OPC, HDD password and software restriction work as in 2.0.
 - Defaults worth knowing:
  - Unticked by default (tick them on *Select Setting Items* if wanted): screen lock after
    inactivity, 15-minute limit for idle RDP sessions, password-protected screen saver,
    SMB signing (Windows 11 signs by default; switch it off on both sides if a product
    cannot cope).
  - Ticked by default: Kerberos limited to AES (a domain user may get a "current
    credentials" prompt; reset that user's password or untick the item), Internet Explorer 11
    disabled, network level authentication and a single session per RDP user, Print Spooler
    refuses client connections, no PnP redirection over RDP, auto logon disabled.
  - PowerShell script-block logging and transcription are on, so a password typed in
    PowerShell ends up in the log: run security utilities that take passwords in cmd.
  - CD/DVD access can be denied only with the Group Policy Editor, not with the tool.
 - Built-in accounts (§3.7.18, §3.7.22): disable or rename the built-in Administrator and
  Guest; avoid names containing admin, root or su; on the dual-redundant platform rename
  ADMINISTRATOR / PATCHUSER with the Redundancy Management Tool.
 - LAPS (§3.7.23): only with linked domain management and 3.0. After installing it (Setup
  summary §2.1.6), enable *Enable Local Admin Password Management* in the GPO of the OU of the
  target computers. The built-in Administrator then gets a different, rotating password on
  each computer (read it with LAPS UI on the domain controller), so do not use that account
  for CI Server.
 - Switching CI Mobile View, General PC or a domain controller between 2.0 and 3.0 (§4.8.3–4.8.4):
  sign in as a `CIX_MAINTENANCE` administrator, run `ResetITSecCondition.cmd`, start the tool
  and choose the version. Back to 2.0: first *Restore* the file
  `PrepareToChangeITSecVer.hed` under `C:\ProgramData\Yokogawa\IA\iPCS\Platform\Security\System\Extension\3.0`.
  For linked domain management, leave the domain, reapply, rejoin and relink.
 - Central management with Active Directory (ch. 6): on the domain controller create a GPO,
  *Import Settings* from `CIX_Standard_2.0.zip` or `CIX_Standard_3.0.zip` (from
  `…\ITSecurity\GPOFiles\<version>`; 3.0 comes from the IT security 3.0 medium), and link it
  to the OU of the CI Server computers. Apply IT security on every client first; change
  settings only in the GPO on the domain controller.
--- a/knowledge/manuals/IM36K10E20-01EN.md
+++ b/knowledge/manuals/IM36K10E20-01EN.md
@ -1,17 +1,19 @@
 ---
 manual: IM 36K10E20-01EN
 title: OPC Interface
-edition: 2nd Edition, Sep. 2023
+edition: 4th Edition, Feb. 2026 (R1.05); first summarised from the 2nd Edition, Sep. 2023 (R1.03)
-version: R1.03
+version: R1.05 (first written for R1.03)
-status: from docs; OPC UA point and certificate forms compared with quick load on the test system 2026-10-01 (user configured a point in the Engineering Module, exported and diffed)
+status: from docs. R1.03 (2026-10-01): OPC UA point and certificate forms compared with quick load on the test system (user configured a point in the Engineering Module, exported and diffed). R1.05 (2026-10-08, read-only): method and mapper datasets, installed mapper files, AOG method displays and the ServerConfig.xml location checked; forms not opened, nothing configured
 ---
-# OPC Interface (R1.03)
+# OPC Interface (R1.05)
-Engineering Module procedures for OPC Classic, OPC UA client and OPC UA PubSub. Concepts,
+Engineering Module procedures for OPC Classic, OPC UA client, the OPC UA Information Model
-setup files and the OPC servers: `IM36K10L45-01EN.md`. Everything here is under
+Mapper (new in R1.05) and OPC UA PubSub. Concepts, setup files and the OPC servers:
-*Configuration → I/O processing → Equipment → (OPC DA client | OPC A&E client | OPC UA Client |
+`IM36K10L45-01EN.md`. Client and PubSub objects are under *Configuration → I/O processing →
-OPC UA PubSub)*. CI Server must be running. Section numbers refer to the manual.
+Equipment → (OPC DA client | OPC A&E client | OPC UA Client | OPC UA PubSub)*. CI Server must be
 running. Section numbers refer to the 4th edition (R1.03 §2.2.6 is now §2.3, PubSub moved from
 ch. 3 to ch. 4).
 ## 1. OPC Classic (§1)
@ -19,25 +21,34 @@ OPC UA PubSub)*. CI Server must be running. Section numbers refer to the manual.
  A&E lines, `OPX` for OPC UA), station (OPC server node and ProgID, status item), group
  (deadband, requested update rate, status item), point (external relation, group, OPC tag,
  browse). Then connect items to points (Tutorial "Define points").
- A&E: line, station (server, subscription filters), subscribed attributes; to show events in
+- A&E: line, station (server, subscription filters; category filter = event category codes of
-  the current alarm overview, map event sources to items. External names must be unique per
+  the A&E server, comma separated), subscribed attributes; to show events in the current alarm
-  station.
+  overview, map event sources to items. External names must be unique per station.
-## 2. OPC UA client (§2)
+## 2. OPC UA client (§2.1)
 Order: line → station → subscription → points (→ methods) → alarm components / event type
 filters / event nodes / template settings (only when alarms are wanted; no alarms are received
-until event nodes are configured).
+until event nodes are configured, and since R1.04 only with `OPXC_ENABLE_EXTENDED_FUNC = YES`,
 see `IM36K10L45-01EN.md` §6).
 | Object | Key fields (dataset field) |
 |---|---|
 | Line | name ≤ 31, equipment node (*None* = this node), **process name starts with `OPX`, ≤ 11 characters** (`EQUIPMENT_MAN`) |
-| Station | name ≤ 19; *Host(:port)* + *Discovery* fill session/server name and endpoint, or type the endpoint (`SERVER_01_ENDPOINT`); redundant servers + *Active server item*; *On scan*; *General communication status item* (`STATUS_ITEM`); security policy and mode; anonymous or user/password; requested session time-out; alarm tab (request active alarms, store all alarms as SOE, severity → priority mapping) |
+| Station | name ≤ 19; *Host(:port)* + *Discovery* fill session/server name and endpoint, or type the endpoint (`SERVER_01_ENDPOINT`); redundant servers + *Active server item* (0 none, 1 server 1, 2 server 2); *On scan*; *General communication status item* (`STATUS_ITEM`; 4th ed. lists 0 preparing, 1 connected, 2 comm error/reconnecting, 3 connect failed, 4 shutdown received, 5 connection recreated — a Boolean item worked on R1.03, ISS-080); security policy and mode; anonymous or user/password; requested session time-out; alarm tab (request active alarms, store all alarms as SOE, severity → priority mapping) |
 | Subscription | publishing interval, lifetime and keep-alive counts, max notifications, priority, publish enabled, status item |
-| Point | external relation Input / Output / Input + Output; subscription; *Namespace*, *Node id type*, *Node Id* (or *Browse path*); read-only *Last value*, *Data type*, *Access level*, *Value rank*; array element; options (own sampling interval, monitoring mode, queue size); conversion (offset, step) |
+| Point | external relation Input / Output / Input + Output; subscription; *Namespace*, *Node id type*, *Node Id* (or *Browse path*; F5 rebrowses); *Read additional node information* (R1.05; clear it for slow links); read-only *Last value*, *Data type*, *Access level*, *Value rank*; array element; options (own sampling interval, monitoring mode, queue size); conversion (offset, step) |
-| Method | namespace, node ID or browse path, process areas |
+| Method (§2.1.6) | name (≤ 255), namespace, node ID type, node ID (or browse path); *Options*: parent object node ID set by hand; *Arguments*: input/output argument types set by hand (use the server's types). Dataset `OPCUAC_METHOD_CALL2_DF`. No process areas any more (set them on the method object's `MTD_TRG` signal) |
-**Observed (2026-10-01)**: in the point form's browse, picking the item itself
+Alarm event types (§2.1.4): `GeneralModelChangeEventType` and, only with
 `OPXC_BASE_MODEL_CHANGE_EVENT` set, `BaseModelChangeEventType`.
 Upgrade from R1.03 (§2.1.6): methods with String or Boolean input arguments must be refreshed —
 edit any field and Apply (rebrowse), or copy the method, set the arguments, delete the old one
 and add the copy. Running a method needs a CI Server object (IM 36K10L45 5th ed. §10.6; skill
 `data-access`, `opcua-client.md` §7).
 **Observed on R1.03 (2026-10-01)**: in the point form's browse, picking the item itself
 (`Objects/<section>/…/<item>`) stores the item **object** (`{"nsid":"<n>"}`), which has no
 value: *Last value*/*Data type* stay empty and the point is never monitored (revised sampling
 interval 0, item status 13). Expanding the item and picking its `Value` node works
@ -46,26 +57,59 @@ interval 0, item status 13). Expanding the item and picking its `Value` node wor
 STRING). The form also fills `OPC_DISPLAY_NAME` and `OPC_TAG_INFO` (browse bookkeeping;
 not needed for quick load). ISS-033.
-## 3. Certificates (§2.2)
+## 3. Certificates (§2.2, §2.3)
 *OPC UA Client → Certificates*: **Trusted**, **Rejected** (server certificates arrive here),
 **Own certificate**. Trust = open the rejected certificate, tick *Trusted*, Apply; reject =
 untick. Restart the Engineering Module to refresh the folders. *Modify* the own certificate
 (name, organisation, country, domain or IP, RSA key strength, signature algorithm, validity).
-**CI Server OPC UA client ↔ CI Server OPC UA server (§2.2.6)**: trust the server certificate
+New in R1.05 (§2.2): the client warns in the Historical Alarm Overview and the UMH message log
 when its own or the server's certificate is about to expire (lead time = hidden
 `OPXC_CERT_EXP_PERIOD_WARN`, 2 months in the installed `epauac_eqp.sup`, verified 2026-10-08).
 **CI Server OPC UA client ↔ CI Server OPC UA server (§2.3)**: trust the server certificate
 on the client; copy the client's own certificate
 (`%TLS_ALLUSERS_PATH%\pki\opxuac\pkiclient\own\certs`) to the server's
 `…\pki\opxuas\pkiserver\trusted\certs`; the manual also asks to tick *Use CI Server entity names
-for nodeids* in `opxuas.sup` and restart the server. On the test system the loopback worked
+for nodeids* in `opxuas.sup` and restart the server. On the R1.03 test system the loopback
-**without** that option, using `itnm` node IDs (ISS-032).
+worked **without** that option, using `itnm` node IDs (ISS-032).
-## 4. OPC UA PubSub (§3)
+## 4. OPC UA Information Model Mapper (ch. 3, App. 1; new in R1.05)
 From docs; installed parts verified on R1.05 (2026-10-08): dataset `UASERVER_MAPPER_DF`,
 `%TLS_WAP_PATH%\cfg\tools\uamapper\` with libraries `UAMapperLibrary_MDIS`, `_None`,
 `_Use_model`.
 - Purpose: publish CI Server data under a standard OPC UA information model (NodeSet file, e.g.
  MDIS or PA-DIM) instead of, or next to, the native CI Server model (server side:
  `IM36K10L45-01EN.md` §7).
 - Rights: `UA_MAPPER_PROJECT_INSERT`, `_MODIFY`, `_DELETE` (already in `SYSTEM_MANAGER`).
 - Workflow (*Tools › OPC UA Information Model Mapper*): **New Mapping** (folder
  `%TLS_WAP_PATH%\cfg\tools\uamapper\mapperprojects\<name>`) → **Configure**: NodeSet file (base
  models in the same folder) and optional library template → **Edit Rules**: per OPC UA object
  type a selection query on CI Server objects or sections (`CLASSNAME = …`, `SECTIONNAME = …`;
  SQL keywords in App. 1), then methods → class names, variables → tag names, events → item or
  external alarm names → **Build** (results can be exported to / imported from CSV;
  `MappingReport.txt`) → **Load** to an OPC UA server process. Removing a mapping does not
  unload it from the server (§3.4.6).
 - Rule-based mapping needs consistent naming or class/object engineering; otherwise map by CSV.
  In enterprise engineering, map on each CI Core. The manual advises trying a mapping on an
  extra OPC UA server instance first (§3.4; instance procedure in `IM36K10L45-01EN.md` §7,
  `<instance>_ServerConfig.xml` in `%TLS_SAV_PATH%`).
 - Dataset `UASERVER_MAPPER_DF`: `NAME`, `DESCRIPTION`, `UA_NAMESPACE`, `UA_MODEL_FILE`,
  `LIBRARY_NAME`, `MAPPING_FILE`, `TARGET_UA_SERVER`, `PROJECT_STATE` (INIT, CONFIGURED,
  MAPPED, DEPLOYED).
 ## 5. OPC UA PubSub (ch. 4)
 UDP publish/subscribe of Data Access values from the CI Server OPC UA server address space
-(OPC visible items). Objects: line (needs its own copy of `ServerConfig.xml` named for the
+(OPC visible items). Needs `OPXUAS_ENABLE_EXTENDED_FUNC = YES` since R1.04
-instance), published datasets, station, writer groups + dataset writers (publisher), reader
+(`IM36K10L45-01EN.md` §7). Objects: line, published datasets, station, writer groups + dataset
-groups + dataset readers (subscriber), then *Upload dataset configurations to runtime*.
+writers (publisher), reader groups + dataset readers (subscriber), then *Upload dataset
-Limits per line: 4 stations, 8 writer groups, 8 reader groups, 32 dataset writers, 32 dataset
+configurations to runtime*. Each extra PubSub line needs its own OPC UA server instance named
-readers, 32 published datasets. Status mapping as for the server (NORMAL → Good; NOT_INIT,
+like the line's server name (own `<instance>_ServerConfig.xml`, which R1.05 keeps in
-UPD_OFF, OFFSCAN, OFFLINE → Uncertain; BAD_VALUE → Bad). Not practiced (needs a PubSub peer).
+`%TLS_SAV_PATH%` — R1.03: `tls\exe`; ISS-081). Limits per line: 4 stations, 8 writer groups,
 8 reader groups, 32 dataset writers, 32 dataset readers, 32 published datasets. Status mapping
 as for the server (NORMAL → Good; NOT_INIT, UPD_OFF, OFFSCAN, OFFLINE → Uncertain; BAD_VALUE →
 Bad). Not practiced (needs a PubSub peer).
--- a/knowledge/manuals/IM36K10L40-01EN.md
+++ b/knowledge/manuals/IM36K10L40-01EN.md
@ -1,12 +1,12 @@
 ---
 manual: IM 36K10L40-01EN
 title: EQUIPMENT Service Engineering - Utilities
-edition: 3rd Edition, Sep. 2023
+edition: 4th Edition, Feb. 2026 (R1.05); content unchanged since the 3rd Edition, Sep. 2023 (R1.03): the revision table lists contact information only
-version: R1.03
+version: R1.05 (first written for R1.03)
-status: from docs; installed programs, setup file and start scripts checked, eqpdbg "Get main info" run read-only on the test system (2026-09-30)
+status: from docs; installed programs, setup file and start scripts checked, eqpdbg "Get main info" run read-only on the R1.03 test system (2026-09-30); on the R1.05 test server files and tool menus checked read-only (2026-10-08), eqpdbg not run there
 ---
-# EQUIPMENT Service Engineering - Utilities (R1.03)
+# EQUIPMENT Service Engineering - Utilities (R1.05)
 Three utilities of the EQUIPMENT Service (the equipment managers `eqp<type>` that talk to
 stations). Section numbers refer to the manual.
@ -37,6 +37,13 @@ normally read hourly.
     1220 Fisher ROC, 1316 HexRepeater, 1636 IEC 61850.
   - Scan rate number: the points' scan interval in ms, or the driver's internal rate number.
 5. Restart CI Server (or the `EQPFRCSCN` process).
 **R1.04 and later:** IEC 61850 (and IEC 104) lines run under an EQT manager, which
 `eqpfrcscn` does not reach. The forced scan for them is `eqtfrcscn`: its template
 `tls\tpl\eqtfrcscn.tpl` has the same `FORCE` / `FCX_EVENT` / `queue_size` keywords and I/O type
 list, with the EQT node and process as arguments. R1.05 installs no `eqtfrcscn.sup`; an
 `eqtfrcscn_start.cmd` in `tls\com` would start it, because `equipment_start.cmd` runs
 `eqt*start.cmd`. The manual does not describe it (ISS-078; checked from files only, not run).
 Example: a change of the trigger item makes 60 s points scan every 10 s for 600 s.
 Long scan intervals can let an RTU close its TCP socket; keep at least one faster item or
 lengthen the RTU's socket timeout.
@ -52,6 +59,9 @@ sends, good answers, bad return code, timeouts, frame errors, bad CRC, retries,
 (`NAME` = `<DD-MON-YY hh:00>/<station>/<line>`), e.g. `CIENG_PLC` with `TIMESPAN` (seconds
 counted in that hour), `SENDS` and `GOODANS` 1560/1560. Only stations that actually sent requests
 appear; the first export (no communicating station) was empty (ISS-021). History type 4.
 R1.05 also installs `eqtiostat` for EQT managers, but its start line in `equipment_start.cmd`
 is commented out (checked 2026-10-08); whether IEC 104/61850 stations reach `STATION_STAT` is
 not checked.
 ## 3. Debugger: `eqpdbg` (§3)
@ -80,9 +90,25 @@ printf '1\n-1\n' | eqpdbg 0 EQPMDC
 Test system: `eqpdbg 0 EQPMDC` main info showed line type 107, both lines attached, 100 ms
 scan interval, 2 slaves, 2 % line load.
-## Installed on the test system
+**`eqtdbg`** (R1.04 and later) is the same debugger for EQT managers: default process `EQT`,
 same action numbers −2…23 (menu strings read from both programs on R1.05, 2026-10-08; not
 run). Use the line's equipment process name, e.g. `EQT850`. Not in the manual (ISS-078).
 ## Installed on the R1.03 test system
 Many drivers `tls\exe\eqp<type>.exe` (e.g. `eqpmdc` Modbus, `eqpfcx` STARDOM, `eqpfam3` FA-M3,
 `eqp850` IEC 61850, `eqpdnp` DNP3); setup files `eqp*.sup` (e.g. `eqpmdc.sup`, `eqpmqtt.sup`,
 `eqpfrcscn.sup`); start scripts `eqpmdc_start.cmd`, `eqpmqtt_start.cmd`. Running managers:
 `eqpmdc`, `eqpmqtt`, `eqpiostat`.
 ## Installed on the R1.05 test server (2026-10-08)
 Program and data under `C:\Yokogawa\CIServer`. `eqp104`, `eqp850` and `eqp850dmp` are gone;
 instead `eqt104`, `eqt850`, `eqt850dmp`, `eqtdbg`, `eqtfrcscn`, `eqtiostat`, `etaman` and the
 data servers `eta10464.dll` / `eta85064.dll`. Setup files `eqtini.sup` (licence only),
 `eta.sup` (protocols run by the EQT framework: `iec61850`, `iec104`), `eta104*.sup`,
 `eta850*.sup`, client file `eqt850.icd`; templates `eqtfrcscn.tpl`, `eqtini.tpl`.
 `equipment_start.cmd` starts `etaman` after `epaman` and runs `eqt*start.cmd`;
 `equipment_stop.cmd` stops `eta*` and `eqt*`. Running: `epaman`, `etaman`, `eqpmdc`,
 `eqpmqtt`, `eqpiostat`. Modbus files (`eqpmdc.sup`, `epamdc*.sup`, `eqpfrcscn.sup`/`.tpl`) are
 identical to R1.03.
--- a/knowledge/manuals/IM36K10L41-01EN.md
+++ b/knowledge/manuals/IM36K10L41-01EN.md
@ -1,12 +1,12 @@
 ---
 manual: IM 36K10L41-01EN
 title: EQUIPMENT Service Engineering - Configuration
-edition: 3rd Edition, Sep. 2023
+edition: 5th Edition, Feb. 2026 (R1.05); first written from the 3rd Edition, Sep. 2023 (R1.03). Changed since: R1.04 §3.4.5/3.4.7/3.4.8, 3.12.2, 3.15, 3.32, 3.40, App. 1 new; R1.05 §3.32, App. 1.3, App. 1.4 new
-version: R1.03
+version: R1.05 (first written for R1.03)
-status: from docs; general parts (§1–3.5) and Modbus (§3.6–3.7) summarized in detail, other drivers as a table; Modbus datasets, eqpmdc.sup and save files checked read-only on the test system (2026-09-30)
+status: from docs; general parts (§1–3.5) and Modbus (§3.6–3.7) summarized in detail, other drivers as a table; Modbus datasets, eqpmdc.sup and save files checked read-only on the R1.03 test system (2026-09-30); R1.05 changes added from the 5th Edition and checked read-only on the R1.05 test server (2026-10-08): Modbus datasets and setup files identical to R1.03
 ---
-# EQUIPMENT Service Engineering - Configuration (R1.03)
+# EQUIPMENT Service Engineering - Configuration (R1.05)
 How CI Server exchanges data with PLCs, RTUs and other systems: lines, stations, scan types,
 points and conversion types, then one chapter per protocol. Section numbers refer to the
@ -19,7 +19,9 @@ manual. Utilities (forced scan, statistics, debugger): `IM36K10L40-01EN.md`.
 - One **plug-in per protocol**: an equipment manager process (e.g. `EQPMDC` for Modbus
  master), its setup file, shared libraries and datasets for line, station, scan type and point.
 - **Defining a line** copies the protocol's template setup file (e.g. `eqpmdc.sup`) and starts
-  an equipment manager instance. The name is free but must start with `eqp`.
+  an equipment manager instance. The name is free but must start with `eqp`; for IEC 60870-5-104 and IEC 61850 (R1.04
  and later) it starts with `eqt` (defaults `EQT104`, `EQT850`; §3.32.1, App. 1.3; for 104 the
  manual still says `eqp104`, ISS-076).
 - Each manager keeps two private save files in `%TLS_SAV_PATH%`: `<process>_MAIN.sav`
  (lines/stations) and `<process>_ITEM.sav` (points), only to start fast. Deleting them loses
  the runtime configuration; repair with `dsschk`. (Test system: `eqpmdc_main.sav`,
@ -163,7 +165,7 @@ start file is enough (see L40 summary).
 | 3.12 | VNET | Vnet/IP | needs Vnet/IP set up (not on Windows 10 test PC) |
 | 3.13 | Host-Host Coupling (`EQPHHC`) | MDUR to another CI Core | read/write points of a remote CI Server |
 | 3.14 | FA-M3 | TCP/IP | |
-| 3.15 | MELSEC | EZSocket (TCP/IP, UDP, serial) | EZSocket must be installed |
+| 3.15 | MELSEC | EZSocket (TCP/IP, UDP, serial) | EZSocket must be installed: installer on the install media (`\Windows\EZSocketPcRedistributableInstaller`), run as administrator; fails if CI Server is not in the default location or its path has spaces (R1.04) |
 | 3.16 | DAQSTATION | TCP/IP | DX, CX, MW100, GX/GP/GM |
 | 3.17 | Beckhoff BK8100 | serial / terminal server | |
 | 3.18 | Allen Bradley PLC5 | DH+ via ControlLogix DHRIO, or DF1 serial/terminal server | BCC checksum only |
@ -176,15 +178,59 @@ start file is enough (see L40 summary).
 | 3.25 | HART router | serial in, terminal server out | re-issues HART commands to a multiplexer |
 | 3.26 | Hex repeater | terminal server | RTU models in `hxr_model.sup` |
 | 3.27 | TIE 870-5 | serial | |
-| 3.28–3.31 | IEC 60870-5-101 / 102 / 103 / 104 | serial or TCP/IP (104: TCP/IP) | |
+| 3.28–3.31 | IEC 60870-5-101 / 102 / 103 / 104 | serial or TCP/IP (104: TCP/IP) | 104 on R1.04+: manager `EQT104`, template `eta104_eqt.sup` with an undocumented `quality_code_parsing` switch (ISS-076, ISS-077) |
-| 3.32 | IEC 61850 | TCP/IP | scan reads; direct write and control models |
+| 3.32 | IEC 61850 | TCP/IP | manager `EQT850` on R1.04+: polling or IEC 61850 reports, report control blocks; see below |
 | 3.33–3.34 | WITS level 0 slave / master (`EQPWITS`, `EQPWITSWR`) | serial / terminal server | drilling data |
 | 3.35 | STX-Bachmann | Modbus to STX PLC | event buffer extension |
 | 3.36 | DTS | Modbus TCP + (S)FTP WITSML | stores in history group `DTS_DATA`; `EQPDTSDBG` |
 | 3.37 | AC-Gateway | ASCII subset (BK, SI, FG, FS) | |
 | 3.38 | Bachmann | M1COM library | |
 | 3.39 | Omron FINS | UDP | CIO, WR, HR, AR, DM areas |
-| 3.40 | Beckhoff ADS | TwinCAT 3 router | |
+| 3.40 | Beckhoff ADS | TwinCAT 3 router | TwinCAT 3 Build 4024 or later (R1.04; was 3.1.4022.2) |
 ### 3.32 IEC 61850 on R1.04 and later
 From docs (5th Edition §3.32) unless marked; installed files checked on the R1.05 test server
 (2026-10-08).
 - **Order:** line, setup file, stations, I/O points, then report control blocks. Give the IED
  engineer the client file `tls\sup\eqt850.icd` once per project (installed on R1.05). The
  manual names the client `EQP850` in one place and `EQT850` elsewhere (ISS-079).
 - **Station:** `DOMAIN_PREFIX` = logical-device name put in front of every I/O address (no
  "/"); default port 102. The old station field `REPORTS` is hidden on R1.05; on upgrade its
  content becomes report control blocks `RCB10`…`RCB50`.
 - **Points:** `IO_ADDRESS`, `TIMESTAMP_ADDRESS`, `QUALITY_ADDRESS` up to 139 characters
  (field length 140 on R1.05, 130 on R1.03). No prefix = polled; prefix `R:` = taken from a
  received report. All three addresses of a point must be in the same report data set, and
  `R:` addresses must be unique. Arrays as `[n]`, n 0–9999. Scan types Slow / Medium / Fast /
  Event; `DATA_TYPE` default Automatic.
 - **Quality:** bits 0–12 carry the IEC 61850 quality. With a control model, bits 13–31 of the
  item quality report Select / Operate / Cancel, `stSeld`, AddCause and command termination
  (timeout `operTimeout`, default 60000 ms). A failed write to a report-sourced item sets BAD
  VALUE and sends a general interrogation to all report control blocks of the station.
 - **Report control blocks, dataset `IEC61850_RCB_DF`** (new; fields checked on R1.05): `NAME`
  = `<station>:<rcb name>`, `STATION`, `RCB_NAME`, `DESCRIPTION`, `RCB_IO_ADDRESS` (required),
  `STANBY_RCB_BLOCKS`, `STANBY_RCB_IO_ADDRESS` (spelled this way), `CONNECTION_TIMEOUT` (default
  5000 ms), `IS_DYN_SETTABLE_OPTFLDS` (default 1; set optional fields dynamically only when the
  IED's SCL file allows it). Trigger options dchg, qchg, dupd, integrity, GI; `RptID` unique per
  block; the EntryID lets the client resume after a reconnect.
 - **Setup file `eqt850.sup`** (template `eta850_eqt.sup`, checked on R1.05): `crit` default
  `8D` (adds the quality criterion); new switch `select_oper_internal = Y|N` (default N; Y
  keeps the R1.03 behaviour of an internal Select).
 ## Appendix 1: upgrade precautions (R1.04 and later)
 From docs (5th Edition App. 1.1–1.4).
 - **From R1.03 with IEC 61850 configured:** the line's process name changes automatically from
  `EQP…` to `EQT…`, but the instance setup file is not renamed: rename `eqp850.sup` to
  `eqt850.sup` and merge it with the new template `eta850_eqt.sup` (old `epa850_eqp.sup`); rename
  and edit `tls\com\eqp850_start.cmd` / `_stop.cmd` to `eqt850_*` with `eqt850.exe` / `EQT850`.
  This can be done by hand or with `%TLS_ROOT_PATH%\tls\com\jupgutl` (log in
  `%TLS_LOG_PATH%\jmrg\`); it is not needed when *Automatic upgrade CI Server configuration* was
  chosen during setup.
 - No precautions for R1.01→R1.02, R1.02→R1.03 or R1.04→R1.05. IEC 104 is not mentioned
  (ISS-076).
 - §3.4.5, 3.4.7, 3.4.8 (STARDOM FCX, VNET and CENTUM status words) were rewritten as tables of
  item statuses; the mapping did not change.
 ## Test system (read-only, 2026-09-30)
--- a/knowledge/manuals/IM36K10L45-01EN.md
+++ b/knowledge/manuals/IM36K10L45-01EN.md
@ -1,17 +1,19 @@
 ---
 manual: IM 36K10L45-01EN
 title: Data Access Engineering
-edition: 3rd Edition, Sep. 2023
+edition: 5th Edition, Feb. 2026 (R1.05); first summarised from the 3rd Edition, Sep. 2023 (R1.03)
-version: R1.03
+version: R1.05 (first written for R1.03)
-status: from docs; installed setup files (odbsrv.sup, opxsys.sup, opxuas.sup, ServerConfig.xml), access_start.cmd, PKI folders, processes and ports checked 2026-10-01; OPC UA client → own OPC UA server loopback verified with CI-Eng-Sample (station CIENG_UA); ODBC not working on the test system (ISS-008); OPC DA/A&E from docs
+status: from docs. R1.03 (2026-10-01): installed setup files (odbsrv.sup, opxsys.sup, opxuas.sup, ServerConfig.xml), access_start.cmd, PKI folders, processes and ports checked; OPC UA client → own OPC UA server loopback verified with CI-Eng-Sample (station CIENG_UA). R1.05 (2026-10-08, read-only on the test server): setup files (opxuas.sup, opxsys.sup, epauac_eqp.sup, opxuac_mon.sup, odbsrv.sup, dbc.sup, jrstsrv.sup, dssana.sup), ServerConfig.xml, PKI folders, processes, ports, data dictionary and dataset definitions compared with R1.03; loopback not re-run. ODBC not working on either system (ISS-008); OPC DA/A&E, RESTful API calls, methods and the imported information model from docs
 ---
-# Data Access Engineering (R1.03)
+# Data Access Engineering (R1.05)
-ACCESS Service connects CI Server data to other software: **ODBC** (SQL on datasets), **OPC
+ACCESS Service connects CI Server data to other software: **ODBC** (SQL on datasets), the
-Classic** (DA and A&E, client and server, DCOM) and **OPC UA** (client and server). Section
+**RESTful API** (R1.04+), **OPC Classic** (DA and A&E, client and server, DCOM) and **OPC UA**
-numbers refer to the manual. Engineering Module forms: `IM36K10E20-01EN.md`. Hands-on:
+(client and server). Section numbers refer to the 5th edition. R1.04 inserted ch. 4 (RESTful
-skill `data-access`.
+API), so OPC chapters moved up by one compared with R1.03 (R1.03 §4–§10 = R1.05 §5–§11; in the
 OPC UA client chapter R1.03 §9.5–9.11 = R1.05 §10.7–10.13). Engineering Module forms:
 `IM36K10E20-01EN.md`. Hands-on: skill `data-access`.
 ## 1. ODBC (§1–§3)
@ -22,23 +24,26 @@ skill `data-access`.
 - `odbsrv.sup`: `PORT` (1583), `USESSL` (default on; certificate
  `%TLS_ROOT_PATH%\tls\pki\odbsrv\SampleServerCertificate.pem`, key `SampleServerKey.pem`),
  `REMOVE_PADDING_SPACES`, trace (`TRACE`, `VERBOSE`, `TRACE_FILE`), hidden data
-  (`TABLE_SUPPRESSION`, `FIELD_SUPPRESSION`, `FIELD_CONCEAL`, all on).
+  (`TABLE_SUPPRESSION`, `FIELD_SUPPRESSION`, `FIELD_CONCEAL`, all on). Unchanged in R1.05
  (verified).
 - Client: install the VC++ 2019 redistributable and `SimbaClientDriverxx.zip` from the medium
  (`install.bat` as administrator); define a DSN with driver `CiSimbaClientDriver` (64-bit) or
-  `CiSimbaClientDriver32`, server IP and port 1583. Before R1.03, uninstall the old Simba parts.
+  `CiSimbaClientDriver32`, server IP and port 1583. SimbaServer is installed and removed with
  CI Server (§3.2). Delete the DSN when ODBC is no longer used. Removing Simba parts from
  before R1.03 is now in App. 1.2.
 - SQL wildcards `%`/`_` vs. MS Office `*`/`?`: escape `_` and `%` in names with `\`.
 - Common errors (§2.3): IM003 driver missing; IM002 DSN unknown; 08S01 SimbaServer not
  running / port mismatch / BUS Service not reachable.
-**Installed (test system)**: `odbsrv.sup` `PORT 1583`, `USESSL YES`, but the folder
+**Installed (R1.03 and R1.05 test systems)**: `odbsrv.sup` `PORT 1583`, `USESSL YES`, but the
-`%TLS_ROOT_PATH%\tls\pki\odbsrv` does not exist and no sample certificate is shipped, so
+folder `%TLS_ROOT_PATH%\tls\pki\odbsrv` does not exist and no sample certificate is shipped, so
 `odbsrv` stops at every start (`CppServerAPI::Run() failed: InitializeSslCtx():
 SSL_CTX_use_certificate_chain_file() failed`, then `DUR-W-REM_PROC, Process ODBSRV exited
 unexpectedly`); port 1583 does not listen. Fix: put a certificate and key there, or set
 `USESSL = NO` (admin; not applied, ISS-008). `access_start.cmd` writes the ODBC registry
 defaults once (when `%TLS_DAT_PATH%\access.new` exists).
-## 2. OPC Classic basics (§4)
+## 2. OPC Classic basics (§5)
 DCOM-based, Windows only. CI Server has DA client (`opxdac`), DA server (`opxdas12`, DA 1.0A
 and 2.0, custom + automation interfaces), A&E client (`opxaec`), A&E server (`opxaes`).
@ -51,7 +56,7 @@ and 2.0, custom + automation interfaces), A&E client (`opxaec`), A&E server (`op
 - Items, sections and objects appear to OPC servers (DA, A&E **and UA**) only with *OPC
  visible* (and every parent section visible).
-## 3. OPC DA client (§5)
+## 3. OPC DA client (§6)
 - One client process per DA line (name given in the line), started/stopped with CI Server;
  stop one with `durstp -msk -t10 -p <client>`. Uses a save file in `%TLS_SAV_PATH%` named
@ -59,22 +64,22 @@ and 2.0, custom + automation interfaces), A&E client (`opxaec`), A&E server (`op
 - Server check every `OPXDAC_SRV_ALIVE` ms (default 30000); station status item: 1 running,
  2 failed, 3 no config, 4 suspended, 5 test. Not connected → mapped items OFFLINE. Group
  status item: 1 active / 0 not active (items offline).
- Setup (`<client>.sup`, else `opxsys.sup`): `OPXDAC_SAFE_CON` (allow connecting to a CI Server
+- Setup (`<client>.sup`, else `opxsys.sup`; §6.3): `OPXDAC_SAFE_CON` (allow connecting to a
-  DA server — **never to the own node or a DURM-connected node: deadlock**), `OPXDAC_PING`
+  CI Server DA server — **never to the own node or a DURM-connected node: deadlock**),
-  (ICMP check before DCOM, fast failure), `…_PING_TIMEOUT` (3 s), `…_DUR_QSZ`, `…_HBEAT`
+  `OPXDAC_PING` (ICMP check before DCOM, fast failure), `…_PING_TIMEOUT` (3 s), `…_DUR_QSZ`,
-  (100 ms), `…_ITMBUF`, `…_FLUSH_GRPQUE` (500 ms), `…_BROWSE_CACHE`, `…_DISABLE_BROWSING`,
+  `…_HBEAT` (100 ms), `…_ITMBUF`, `…_FLUSH_GRPQUE` (500 ms), `…_BROWSE_CACHE`,
-  `…_CHECK_MAPPING`, `…_ASYNC_WRITE`, `…_USE_CANONICAL_DATA_TYPE` (default asks VT_R8),
+  `…_DISABLE_BROWSING`, `…_CHECK_MAPPING`, `…_ASYNC_WRITE`, `…_USE_CANONICAL_DATA_TYPE` (default
-  `…_IGNORE_BAD_QC_UPDATES`, `…_CLEAR_SAV_FILE`, `…_DISABLE_STATUS_UPDATE`.
+  asks VT_R8), `…_IGNORE_BAD_QC_UPDATES`, `…_CLEAR_SAV_FILE`, `…_DISABLE_STATUS_UPDATE`.
 - Advice: one OPC server per client process (a DCOM time-out blocks the whole process).
  Quick-load templates: export `LINE_DF`, `STATION_DF`, `OPC_GROUP_DF`, `ITEM_DF`,
  `POINT_DF` of one station made in the Engineering Module.
- **DCOM tunnelling**: run the client on a PC in the OPC server's domain (CI Server with BUS,
+- **DCOM tunnelling** (§6.6): run the client on a PC in the OPC server's domain (CI Server with
-  DATABASE, EQUIPMENT, ACCESS licence) connected to the host by MDUR (`durm_<n>_udp.sup`,
+  BUS, DATABASE, EQUIPMENT, ACCESS licence) connected to the host by MDUR
-  port ≥ 20000, `dur.sup` host node = CI Core), *use DCOM tunnelling to host* on the client's
+  (`durm_<n>_udp.sup`, port ≥ 20000, `dur.sup` host node = CI Core), *use DCOM tunnelling to
-  setup file; on the host add the line with *Equipment node* = tunneller node. Use `intmon`
+  host* on the client's setup file; on the host add the line with *Equipment node* = tunneller
-  node monitoring with *Set slave items offline when node unavailable*.
+  node. Use `intmon` node monitoring with *Set slave items offline when node unavailable*.
-## 4. OPC DA server (§6)
+## 4. OPC DA server (§7)
 - COM server `opxdas12.exe`, ProgID `Yokogawa.CIOpcDas.<version>`, DUR name `OPXDAS`; started by
  COM on the first client connect; stop with `durstp -p opxdas` (clients get a shutdown).
@ -90,11 +95,11 @@ and 2.0, custom + automation interfaces), A&E client (`opxaec`), A&E server (`op
  `secpol` (*Create permanent shared objects*, *Network access: Classic*), firewall rules for
  `opxdas12.exe`, `opxdac.exe`, `opcenum.exe`, `mmc.exe` and DCOM — not needed where the IT
  Security Tool is applied. Same account/password on both sides in a workgroup.
- Troubleshooting: `OCSRegistryCheck.exe` (GUI; installed), `opxdas12 /RegServer`,
+- Troubleshooting (§7.9): `OCSRegistryCheck.exe` (GUI; installed), `opxdas12 /RegServer`,
  `opccommonsetup` / `opcenum /RegServer` / `opcenum /Service` (set the service to automatic),
  `regsvr32 opcproxy.dll` and `opccomn_ps.dll` in `%WINDIR%\SysWOW64`. Test locally first.
-## 5. OPC A&E client and server (§7, §8)
+## 5. OPC A&E client and server (§8, §9)
 - Client `opxaec` (default name `OPXAEC`, `-n` for more), setup `<name>.sup` or `opxsys.sup`
  (`OPXAEC_SAFE_CON` — same deadlock rule, `…_DUR_QSZ`, `…_SRV_ALIVE`, `…_PING_TIMEOUT`,
@ -104,89 +109,162 @@ and 2.0, custom + automation interfaces), A&E client (`opxaec`), A&E server (`op
  `…_ALM_REC_DELAY` (30 s), `…_BROWSE_PREP_INI`, and `OPXAES_EC_ATTR_*` switches for the
  CI Server-specific event attributes (old/new value, quality, status, alarm state, item
  description, units, node, group, number, sub-number). Installed: all on.
 - Installed R1.05 only (verified 2026-10-08, not in the manual, ISS-085): `OPXAES_DIR_ALM`
  (YES) switches "Direct" alarm events of the A&E server.
-## 6. OPC UA client (§9)
+## 6. OPC UA client (§10)
 - OPC UA TCP only; security by X.509 certificates (application authentication), user
  anonymous or name/password; modes None/Sign/SignAndEncrypt; policies Basic256Sha256,
  Aes128-Sha256-RsaOaep, Aes256-Sha256-RsaPss recommended (None, Basic128Rsa15, Basic256 not).
- Data types supported: Boolean, (S)Byte, (U)Int16/32, Float, Double, String and others as in
+- Data types (§10.3.4, new in R1.04): Boolean → Boolean; SByte, Byte, Int16, UInt16, Int32,
-  Table 9.4.2-2; 1-D and 2-D arrays by element. OPC UA status → CI Server quality: 0 good,
+  Integer → Integer; UInt32, Int64, UInt64, Float, Double, Number, UInteger, Duration → Real; String, ByteString,
-  1 bad, 2 uncertain.
+  LocalizedText, DateTime / UtcTime (only `YYYY-MM-DDThh:mm:ss.sssZ`) → String of up to 250
- A&C: external alarms from ConditionType and derived types (ALARM/NORMAL events), other
+  bytes; ExtensionObject only for EURange and EngineeringUnits; enumerations as Int32. Unsigned
  types take no negatives, 64-bit types no decimals. One array element per point (methods take
  no arrays). A failed conversion is logged and the item gets status Bad. OPC UA status →
  CI Server quality: 0 good, 1 bad, 2 uncertain.
 - A&C (§10.4): **only with `OPXC_ENABLE_EXTENDED_FUNC = YES`** in the client's setup file (R1.04+,
  default NO). External alarms from ConditionType and derived types (ALARM/NORMAL events), other
  events INFORMATIONAL; filters by event type, component, event node; severity → priority
-  table (901–1000 → 1 … 1–100 → 15), per station; don't manage
+  table (901–1000 → 1 … 1–100 → 15), per station; don't manage NonExclusiveLimitAlarmType.
-  NonExclusiveLimitAlarmType. Only `NodeDeleted` model changes are handled.
+- Model change events (§10.5, R1.04): `GeneralModelChangeEvent` is handled per change type —
- Redundancy: no client redundancy (use HAC); servers: transparent, or non-transparent cold
+  node/reference added: the affected points are recreated; node/reference deleted: the linked
-  backup with two endpoints (*Active server item* 0/1/2).
+  items go offline and external alarms get a ConditionRefresh; data type changed: nothing.
- Engineering objects: line (starts a client process; **name must start with `OPX`**, max 11
+  `BaseModelChangeEvent` (no detail; recreate all points and event nodes) only with
-  characters), station (= session), subscription, point (= monitored item), alarm component /
+  `OPXC_BASE_MODEL_CHANGE_EVENT = YES` (default NO). Bursts within 10 s are handled once,
-  event type filter / event node / template settings, method.
+  handling waits during alarm floods, and the server must support Read and Browse.
- Certificates: the client process creates `<host>_<PROCESS>.der` in
+- Methods (§10.6, R1.04): a CI Server object per method with attribute `MTD_KEY` and signals
  `MTD_TRG`, `MTD_RET`, `MTD_IN_ARG_n`, `MTD_OUT_ARG_n` (≤ 10 each; sample Java class
  `UAC_MTD_JBASE`); a method record per station and one point (namespace and node ID
  `CIX_UAC_MTD`, Input + Output) connected to `MTD_TRG`; symbol/display (demo
  `AOG_UAC_Method_Demo`). Dataset `OPCUAC_METHOD_CALL2_DF` (R1.03: `OPCUAC_METHOD_CALL_IN_DF` /
  `…_OUT_DF`, removed). Procedure: skill `data-access`, `opcua-client.md` §7.
 - Redundancy (§10.7): no client redundancy (use HAC); servers: transparent, or non-transparent
  cold backup with two endpoints (*Active server item* 0/1/2).
 - Engineering objects (§10.9): line (starts a client process; **name must start with `OPX`**,
  max 11 characters), station (= session), subscription, point (= monitored item), alarm
  component / event type filter / event node / template settings, method. The station's
  communication status item is called Boolean in §10.9.2, but IM 36K10E20 4th ed. lists states
  0–5 (ISS-080).
 - Certificates (§10.9.10): the client process creates `<host>_<PROCESS>.der` in
  `%TLS_ALLUSERS_PATH%\pki\opxuac\pkiclient\own\certs` (also listed in dataset
-  `OPCUAC_PKI_CERTIFICATES_DF`); server certificates arrive in `…\pkiclient\rejected` and must be
+  `OPCUAC_PKI_CERTIFICATES_DF`; verified on R1.03 and R1.05); server certificates arrive in
-  trusted (Engineering Module, or move to `…\pkiclient\trusted\certs`); folders `deleted`,
+  `…\pkiclient\rejected` and must be trusted (Engineering Module, or move to
-  `rejected` added by CI Server. The server must trust the client's certificate too.
+  `…\pkiclient\trusted\certs`); folders `deleted`, `rejected` added by CI Server. The server
- Setup (`<process>.sup`, else `opxuac.sup`): `OPXC_DUR_QUEUE_SIZE` (10000 kB), heartbeats,
+  must trust the client's certificate too. Expiry warnings: see `IM36K10E20-01EN.md` §3.
-  buffers, `OPXC_COM_STAT_CHK_INTERVAL` (10 s), `OPXC_STATION_CON_TRY_INTERVAL` (30 s; observed
+- Setup (§10.11; `<process>.sup`, else the template **`epauac_eqp.sup`** — the R1.03 edition
-  retries every ~35 s), `OPXC_TIMESTAMP_OPTION` (SERVER/SOURCE), `OPXC_LOG_LEVEL`, service and
+  named `opxuac.sup`, which is not installed on R1.03 or R1.05, ISS-084): `OPXC_DUR_QUEUE_SIZE`
-  session time-outs, `OPXC_SERVICE_COMPLIANCE`. Log file `%TLS_LOG_PATH%\<PROCESS>.log`.
+  (10000 kB), heartbeats, buffers, `OPXC_COM_STAT_CHK_INTERVAL` (10 s),
- Quick load (§9.10–9.11): `OPCUAC_LINE_DF`, `…_STATION_DF`, `…_SUBSCRIPTION_DF`, `…_POINT_DF`
+  `OPXC_STATION_CON_TRY_INTERVAL` (30 s; observed retries every ~35 s on R1.03),
-  (+ alarm and method datasets). Dataset `OPCUAC_TAG_DF` browses a connected server
+  `OPXC_TIMESTAMP_OPTION` (SERVER/SOURCE), `OPXC_LOG_LEVEL`, service and session time-outs,
-  (filter on `OPC_STATION_NAME` and `OPC_TAG_PATH`).
+  `OPXC_SERVICE_COMPLIANCE`, and new in R1.04 `OPXC_BASE_MODEL_CHANGE_EVENT`,
  `OPXC_ENABLE_EXTENDED_FUNC` (both NO). Log file `%TLS_LOG_PATH%\<PROCESS>.log`.
 - **Installed R1.05 `epauac_eqp.sup`** (verified 2026-10-08, ISS-083):
  `OPXC_SERVICE_CALL_TIME_OUT = 60` (manual default 10 s); undocumented `OPXC_DISABLE_SAV_FILE`
  (NO), `OPXC_ALARM_TIME_ATTRIBUTE` (tab *Alarm Time*), hidden `OPXC_CERT_EXP_PERIOD_WARN`
  (2 months). `opxuac_mon.sup` is unchanged from R1.03 (none of the new keywords).
 - Quick load (§10.12–10.13): `OPCUAC_LINE_DF`, `…_STATION_DF`, `…_SUBSCRIPTION_DF`,
  `…_POINT_DF` (+ alarm and method datasets). Dataset `OPCUAC_TAG_DF` browses a connected
  server (filter on `OPC_STATION_NAME` and `OPC_TAG_PATH`; R1.05 adds `REBROWSE` and
  `READ_NODE_INFO`). Line, station, subscription and point definitions are identical in R1.03
  and R1.05 (verified).
 - Installed: `opxuac_mon` (a monitor instance) is started by `access_start.cmd`.
 - Upgrade from R1.03 (App. 1.3): set `OPXC_ENABLE_EXTENDED_FUNC` if A&C was used; methods
  driven by dataset field updates no longer work — rebuild classes (`MTD_*`, extended reset),
  symbols and displays, and re-save methods with String or Boolean input arguments. App. 1.4
  (R1.05): one class name per method object.
-## 7. OPC UA server (§10)
+## 7. OPC UA server (§11)
 - Since R1.04 the server offers only Data Access and methods by default. **Alarms &
  Conditions, HistoryRead and PubSub need `OPXUAS_ENABLE_EXTENDED_FUNC = YES`** in `opxuas.sup`
  (ch. 11 intro, §11.6.2; installed default NO, verified on R1.05). An upgrade with the
  automatic configuration merge sets it; otherwise set it by hand if these were used
  (App. 1.3).
 - Process `OPXUAS` (`opxuas -n opxuas`, started by `access_start.cmd`; stop `durstp -m -p
  opxuas`), Unified Automation C++ SDK, port **34493**. Log `%TLS_ALLUSERS_PATH%\log\OPXUAS.log`
  and `OpxUas_Sdk*.log`.
- Visible data: sections, objects, items with *OPC visible*; items also need **Read** (read
+- Visible data (§11.1.4): sections, objects, items with *OPC visible*; items also need **Read**
-  values, browse into the item) and **Write** (write values, alarm methods). Parent sections must
+  (read values, browse into the item) and **Write** (write values, alarm methods). Parent
-  be visible. Without Read the item is listed but browsing into it fails
+  sections must be visible. Without Read the item is listed but browsing into it fails
-  (`UncertainNotAllNodesAvailable`).
+  (`UncertainNotAllNodesAvailable`). External alarms: OPC visible / read / write / manual reset
- Users: anonymous = like `OPC_UA_SERVER_READ`; authorisation actions `OPC_UA_SERVER_READ`
+  in the station's alarm template settings.
-  (browse, read, history) and `OPC_UA_SERVER_MODIFY` (+ write, methods).
+- Users (§11.1.5–11.1.6): anonymous = like `OPC_UA_SERVER_READ`; authorisation actions
- Address space: `Objects` → sections (folders) → objects → items (`CIItemNumericType`,
+  `OPC_UA_SERVER_READ` (browse, read, history) and `OPC_UA_SERVER_MODIFY` (+ write, methods).
-  `…BooleanType`, `…StringType`, `…NumericSubType`) with child nodes such as `Value`,
+  Anonymous access is governed by the `dssana.sup` user interface "Anonymous Via OPC UA
-  `Status`, `Blocked`, `Offline`, `HMIInfo`, and alarm condition nodes. Types are in
+  Server" (`OPXUASANY`): installed default (R1.03 and R1.05) is no login with profile
-  `http://www.yokogawa.com/CI_Server/` (ns 3 in the manual). **CI Server entities (sections,
+  `CI_NO_LOGIN_OPCUAS` for local clients and *Manual CI Server* for remote clients. With AD
-  items) are in namespace `urn:Yokogawa:CI_SERVER_OPC_UA_SERVER`** (verified by browsing;
+  integration, "Via OPC UA Server" + *Automatic* needs no AD password.
-  the manual does not name it, ISS-032).
+- Address space (§11.3, now called the **native information model**): `Objects` → sections
  (folders) → objects → items (`CIItemNumericType`, `…BooleanType`, `…StringType`,
  `…NumericSubType`) with child nodes such as `Value`, `Status`, `Blocked`, `Offline`, `HMIInfo`,
  and alarm condition nodes. Types are in `http://www.yokogawa.com/CI_Server/` (ns 3 in the
  manual). **CI Server entities (sections, items) are in namespace
  `urn:Yokogawa:CI_SERVER_OPC_UA_SERVER`** (verified by browsing on R1.03; the manual does not
  name it, ISS-032).
 - NodeIds are JSON strings: `{"nsid":"<namespace id>"}` for the entity,
  `{"0":"Value","nsid":"<n>"}` for its value; or by name: `{"0":"Value","itnm":"<item>"}`
-  (case sensitive; verified). The `nsid` changes when the item is recreated — prefer `itnm`.
+  (case sensitive; verified on R1.03). The `nsid` changes when the item is recreated — prefer
-  `OPXUAS_USE_NAME_NODEIDS` makes the server use names in its own IDs.
+  `itnm`. `OPXUAS_USE_NAME_NODEIDS` makes the server use names in its own IDs.
 - Status mapping: NORMAL → Good; NOT_INIT, UPD_OFF, OFFSCAN, OFFLINE, UNREACH →
  BadNoCommunication; BAD_VALUE → Bad. Types: Boolean, Int32, Double, String. Priority →
-  severity: 1 → 1000, 2 → 900 … 15 → 50, 0 → 1 (changed in R1.03).
+  severity: 1 → 1000, 2 → 900 … 15 → 50, 0 → 1 (since R1.03).
- History: items in a history group show HistoryRead; max 5000 values per node per call.
+- History (§11.3.3; extended functions): items in a history group show HistoryRead; max 5000
- Alarm methods: Acknowledge, Confirm (= acknowledge), Disable/Enable (force to normal);
+  values per node per call.
-  external alarms Acknowledge/Confirm passed to the source; `CIManualReset` for CENTUM.
+- Alarm methods (extended functions): Acknowledge, Confirm (= acknowledge), Disable/Enable
- `opxuas.sup`: General (`FTFW_*` queue, heartbeat, log), OPC UA Server tab
+  (force to normal); external alarms Acknowledge/Confirm passed to the source;
  `CIManualReset` for CENTUM.
 - **Imported information model (§11.4, new in R1.05)**: a standard NodeSet file (UANodeSet 1.05
  schema) is mapped to CI Server entities with the OPC UA Information Model Mapper
  (`IM36K10E20-01EN.md` §4) and loaded as `%TLS_DAT_PATH%\<queue>_<NodeSet file>.xml` (one per
  server process, reloaded at server start). Mapping: section/object → Object; method object
  (`MTD_*` class; sample `UAS_MTD_JBASE`) → Method; item/sub-item → Variable; item alarm or
  external alarm → Event. OPC visible / Read / Write still apply. Once loaded, the native model
  is hidden unless `OPXUAS_ENABLE_OWN_MODEL_TREE` (manual name `…_NATIVE_MODEL_TREE`) is YES.
  Variables: no arrays, basic types only; out-of-range values give `BadOutOfRange` (item
  status unchanged). Method calls return OPC UA status codes (e.g. `BadUserAccessDenied`,
  `BadNotExecutable` when the item is blocked or the object not OPC visible). Rights:
  `UA_MAPPER_PROJECT_INSERT` / `_MODIFY` / `_DELETE` (in `SYSTEM_MANAGER`), dataset
  `UASERVER_MAPPER_DF`.
 - `opxuas.sup` (§11.6): General (`FTFW_*` queue, heartbeat, log), OPC UA Server tab
  (`OPXUAS_OPTIONAL_NODES`, `…_MODEL_CHANGE_EVENTS`, `…_USE_NAME_NODEIDS`,
  `…_USE_DYNAMIC_SCANRATE`, `…_SOURCE_TIME_STAMPS`, `…_USE_RAW_STATUS`,
-  `…_VARIABLE_CACHE_SIZE` 100000, `…_NUM_VALUES_PER_NODE` 5000), Alarm settings (`EVENTS` =
+  `…_VARIABLE_CACHE_SIZE` 100000, `…_NUM_VALUES_PER_NODE` 5000, and new
-  ALARM, ACKN, DEACT, INFO), Logging. Installed keyword names: `OPXUAS_DYNAMIC_SCANRATE`
+  `…_ENABLE_NATIVE_MODEL_TREE`, `…_ENABLE_EXTENDED_FUNC`), Alarm settings (`EVENTS` = ALARM,
-  (manual `…_USE_DYNAMIC_SCANRATE`) and extra `OPXUAS_SET_HIGH_PRIO_15` (ISS-034).
+  ACKN, DEACT, INFO), Logging. `OPXUAS_MODEL_CHANGE_EVENTS` now needs the extended functions;
- `%TLS_ROOT_PATH%\tls\exe\ServerConfig.xml`: endpoint `opc.tcp://[NodeName]:34493`; trust list
+  it sends BaseModelChangeEvents (also on NodeSet load/unload) and GeneralModelChangeEvents for
-  `…\pki\opxuas\pkiserver\trusted\certs`, rejected `…\pkiserver\rejected` (created at the first
+  root-level entities — deeper levels need an item `NodeVersion` (or `<process>_NodeVersion`,
-  rejection), own certificate `ciserveruaserver.der`. **Installed**: only Basic256Sha256,
+  OPC visible + Read) at that level.
 - **Installed keyword names differ** (verified R1.03 and R1.05): `OPXUAS_DYNAMIC_SCANRATE`
  (manual `…_USE_DYNAMIC_SCANRATE`), extra `OPXUAS_SET_HIGH_PRIO_15` (ISS-034); R1.05:
  `OPXUAS_ENABLE_OWN_MODEL_TREE` (manual `…_NATIVE_MODEL_TREE`) and hidden
  `OPXUAS_METHOD_TIMEOUT_MARGIN` (10000 ms) (ISS-082).
 - `ServerConfig.xml` (§11.7): the manual still gives `%TLS_ROOT_PATH%\tls\exe`; **installed
  R1.05 has it only in `%TLS_SAV_PATH%`** (R1.03: `tls\exe`; ISS-081). Endpoint
  `opc.tcp://[NodeName]:34493`; trust list `…\pki\opxuas\pkiserver\trusted\certs`, rejected
  `…\pkiserver\rejected` (created at the first rejection), own certificate
  `ciserveruaserver.der`. **Installed (R1.03 and R1.05)**: only Basic256Sha256,
  Aes128_Sha256_RsaOaep, Aes256_Sha256_RsaPss with Sign / SignAndEncrypt (no None endpoint);
  anonymous, user/password **and certificate** user tokens enabled (manual: certificate off,
-  ISS-034); `AutomaticallyTrustAllClientCertificates` false.
+  ISS-034); `AutomaticallyTrustAllClientCertificates` false. The R1.05 file adds SDK sections
- First connection of any client: trust the server certificate on the client, then move the
+  (role configuration, user/password management, PubSub settings).
-  client certificate from the server's `rejected` to `trusted\certs`. UaExpert is the
+- First connection of any client (§11.1.6): trust the server certificate on the client, then
  move the client certificate from the server's `rejected` to `trusted\certs`. UaExpert is the
  suggested test client.
- Discovery: LDS on 4840 only when several servers are on a host; GDS for central certificate
+- Extra server instances (for PubSub lines or to test an information model): copy
-  management (concepts only).
+  `ServerConfig.xml` to `<instance>_ServerConfig.xml` with another port, copy `opxuas.sup` to
  `<instance>.sup`, add a start line in `access_start.cmd`; instance names start with `OPX`
  (IM 36K10E20 4th ed. §3.4).
 - Discovery (§11.8): LDS on 4840 only when several servers are on a host; GDS for central
  certificate management (concepts only).
 ## 8. RDBMS data exposure (not in this manual)
 IM 36K10L45 does not describe RDBMS data exposure; it is in the Tutorial (IM 36K10G10 ch. 10)
 and the item form (IM 36K10C10 §3.3). Summary here because it is an ACCESS-type interface;
-**tested in R1.05 only** (user system, 2026-10-02; R1.03 files checked read-only and identical).
+**tested in R1.05 only** (user system, 2026-10-02; R1.03 files checked read-only and identical;
-Procedure: skill `data-access`, task `rdbms-exposure.md`.
+R1.05 files re-checked 2026-10-08). Procedure: skill `data-access`, task `rdbms-exposure.md`.
 - Processes `DBCSND` (sender, subscribes to DSS data) and `DBCDEM` (receiver, writes to MS SQL
  Server via ODBC); setup file `dbc.sup` (sender and receiver tabs; connection string
@ -201,3 +279,29 @@ Procedure: skill `data-access`, task `rdbms-exposure.md`.
  log disagree (ISS-058).
 - The CI Service account `.\CIX_PROCESS` is local, so a remote SQL Server needs a SQL login and
  mixed mode (ISS-059).
 ## 9. RESTful API (§4, new in R1.04)
 From docs; port 34597 listening and the `jrstsrv.sup` keywords verified on R1.05 (2026-10-08).
 No request was sent.
 - HTTPS server installed with CI Server and started/stopped by ACCESS Service, on a CI Core or
  on a CI Portal (reaching the core over MDUR). Not supported by CI View, Remote Connect or
  enterprise setups. Nothing to install on the client.
 - Authentication: HTTP Basic (CI Server user) plus an API key sent in the `x-api-key` header.
  Keys are made in the Engineering Module (*Authorisation › Users*, *Add API Key*, type RESTful
  API), one per user; stored in dataset `API_KEYS_DF`.
 - `jrstsrv.sup` (§4.2.1): `JRST_MAX_RECORDS` (records per reply, default 100),
  `JRST_USE_TWO_WAY_SSL` (default off: client trusts the server's self-signed certificate in
  `%TLS_ALLUSERS_PATH%\pki\jrstsrv\keystore`), `JRST_READ_ONLY_MODE` (default on),
  `JRST_NETWORK_PORT` (34597), `JRST_USER_CACHE_TIME` (600 s, must be > 0),
  `JRST_CUSTOM_DATASETS` (user datasets with read/write rights).
 - Requests (§4.3.2): `https://<host>:34597/jrest/v2/<entity type>/<function>` with OData
  options `$filter`, `$select`, `$top`, `$skip`; replies are OData JSON. Entity sets `Tags`,
  `EventCategories`, `EventRecords`. Functions: `GetHistory` (one tag, ISO 8601 times, sample
  interval in s; highest-priority history group), `GetHistoryMultiTag` (≤ 5 tags),
  `GetEventHistory`, `GetAuditInfo`, `GetCurrentAlarms`, `AcknowledgeAlarms` (several per
  request), `UpdateItems` (value, optional quality and status — status must match
  `STATUS_DF.NAME`), `ReadDataset` and `Dataset` (PUT/PATCH/DELETE on custom datasets).
 - Status codes (§4.3.3): 200, 204, 400 (bad URL or no data), 401 (rights or credentials), 404,
  405, 500, 503.
--- a/knowledge/progress.md
+++ b/knowledge/progress.md
@ -43,12 +43,12 @@ and its row here is updated.
 | Skill / area | Manual changes after R1.03 | R1.05 status | Notes |
 |---|---|---|---|
 | `system-check` | — | re-checked (read-only) | Version, paths, service, node, time on the R1.05 test server 2026-10-08. Start/stop not repeated (shared server). |
-| `installation-security` | C10, C30 (large: IT security 3.0, LAPS, upgrade merge `jupgutl`, PRM) | manual diff read | |
+| `installation-security` | C10, C30 (large: IT security 3.0, LAPS, upgrade merge `jupgutl`, PRM) | re-checked (read-only) | 2026-10-08: skill, summaries and `tools/setup_check.ps1` updated to R1.05. Setup check run by hand on the R1.05 test server (the script itself was not run there). IT security cannot be verified there (Windows Server 2025, IT Security Tool not installed). ISS-086–090. |
-| `data-access` | L45, E20 (large: OPC UA methods, information model mapper, certificate expiry), L50 dataset rename | manual diff read | |
+| `data-access` | L45, E20 (large: REST API, OPC UA methods, information model mapper, certificate expiry, extended functions off by default), L50 dataset rename | re-checked (read-only) | 2026-10-08: skill and summaries updated, L45 section numbers remapped. Setup files, datasets, ports and certificates checked; OPC UA loopback not re-run (shared server). Sample qli files unchanged. ISS-080–085. |
-| `equipment` | L41 (IEC 61850, item status, App. 1); IEC 104/61850 drivers moved to `eqt`/`eta` | manual diff read | |
+| `equipment` | L41 (IEC 61850, item status, App. 1); IEC 104/61850 drivers moved to `eqt`/`eta` | re-checked (read-only) | 2026-10-08: Modbus datasets, setup files and tools identical to R1.03; EQT family, IEC 61850 report control blocks and upgrade steps added. `eqpdbg` not re-run on R1.05 (blocked as a remote command). Sample qli files unchanged. ISS-076–079. |
 | pyTOOLS (new) | P40 new | not started | No skill yet. |
 | `graphics` | C50, C60, R30 (small) | manual diff read | |
-| `history-management` | C40 §4.2 (REST API, pyTOOLS) | manual diff read | |
+| `history-management` | C40 §4.2 (REST API, pyTOOLS) | manual diff read | The REST API itself is described in skill `data-access` (L45 ch. 4); link to it from here. |
 | `portal-setup` | R10 §3.3 | manual diff read | |
 | `system-management` | J10 §2.9.1, L50 | manual diff read | |
 | `item-engineering` | C10 §2.2 | manual diff read | |
--- a/knowledge/version-differences.md
+++ b/knowledge/version-differences.md
@ -31,7 +31,7 @@ until they are re-checked.
 | IEC 60870-5-104 and IEC 61850 drivers | New driver family `eqt*` / `eta*`: `eqt104`, `eqt850`, `eqt850dmp`, `eqtdbg`, `eqtfrcscn`, `eqtiostat`, `etaman`, `eta104*.sup`, `eta850*.sup`, `eqtini.sup`, `eqt850.icd`, `eqtfrcscn.tpl`, `eqtini.tpl` | `eqp104`, `eqp850`, `eqp850dmp`, `epa104*.sup`, `epa850*.sup` (the drivers left the `eqp` EQUIPMENT family) |
 | IEC 61850 configuration | Quick load / form programs `iec61850_line_u0104`, `iec61850_station_u0104`, `iec61850_point_u0105`, `iec61850_rcb_u0105` | — |
 | OPC UA | `opcuac_method_u0104` (OPC UA client methods), `opcuac_station_u0104`, `opcaec_station_u0104` | `opcaec_station_u0103` |
-| REST API | `jrstsrv.jar`, `jrstsrv.sup`, `jrstsrv.tpl` (RESTful API server, see IM 36K10C40 §4.2) | — |
+| REST API | `jrstsrv.jar`, `jrstsrv.sup`, `jrstsrv.tpl` (RESTful API server on TCP 34597, IM 36K10L45 ch. 4; skill `data-access`) | — |
 | Upgrade | `jupgutl.cmd`, `jmrg.jar` (merge configuration files on upgrade, IM 36K01C10 ch. 3) | — |
 | Data access | `dacbackfill.cmd`, `intimpdac.exe` (OPC DA backfill; not yet investigated) | — |
 | Graphics | `connectrdp.cmd` (Edit Module *RDP Connect* action, IM 36K10C50 §2.31) | — |
@ -56,7 +56,7 @@ the R1.04 and R1.05 revision tables.
 | IM 36K10L45 Data Access Engineering | R1.04: ch. 4 new, §10.3.4, 10.5, 10.6 new, setup-file parameters in §10.4, 10.9, 11, 11.5.2. R1.05: §11.4 new, §11.1.6 note, §11.6.2 setup file, App. 1.3 | `data-access` |
 | IM 36K10E20 OPC Interface | R1.04: parent object node ID and arguments of OPC UA methods. R1.05: certificate-expiry notifications, ch. 3 new *OPC UA Information Model Mapper* (map external OPC UA entities to CI Server), App. 1 SQL keywords | `data-access` |
 | IM 36K10L41 EQUIPMENT Configuration | R1.04: item status descriptions (§3.4.5–3.4.8), §3.12.2, §3.15, IEC 61850 functions (§3.32), App. 1 new (precautions on upgrade to R1.04). R1.05: §3.32, App. 1.3, App. 1.4 new | `equipment` |
-| IM 36K10L50 Data Set Service Engineering | R1.04: OPC UA client method dataset renamed `OPCUAC_METHOD_CALL_IN_DF` → `OPCUAC_METHOD_CALL2_DF` | `system-management`, `data-access` |
+| IM 36K10L50 Data Set Service Engineering | R1.04: OPC UA client method dataset renamed `OPCUAC_METHOD_CALL_IN_DF` → `OPCUAC_METHOD_CALL2_DF` (installed: `…CALL_IN_DF` and `…CALL_OUT_DF` both gone); new datasets `IEC61850_RCB_DF`, `UASERVER_MAPPER_DF`, `API_KEYS_DF` | `system-management`, `data-access` |
 | IM 36K10C40 Engineering Module – Historical | R1.04 §4.2: external access to history now lists ODBC, .NET API, **RESTful API**, **pyTOOLS** (C API no longer listed) | `history-management` |
 | IM 36K10C50 Edit Module | R1.04: §2.22 properties, §2.31 *Password Check* action, §4.12 update item/parameter. R1.05: §2.22, 2.25, 2.26, 2.33 properties, §2.31 *RDP Connect* action | `graphics` |
 | IM 36K10C60 Advanced Operating Graphics | R1.04 §1.2.2: demo displays | `graphics` |
@ -77,7 +77,8 @@ content is expected to hold.
 Order (biggest change first), tracked in `progress.md` under *R1.05 re-check*:
 1. `system-check` (paths, version string): done in the baseline.
-2. `installation-security`, `data-access`, `equipment`: real manual changes.
+2. `installation-security`, `data-access`, `equipment`: real manual changes. Re-checked read-only 2026-10-08
   (ISS-076–090). IM 36K10L45 section numbers moved by one chapter from ch. 4 on (new ch. 4 REST API).
 3. New pyTOOLS manual (P40) and the REST API.
 4. `graphics`, `history-management`, `portal-setup`, `system-management`.
 5. All other skills: re-test the task files on R1.05, no manual change expected.
--- a/tools/setup_check.ps1
+++ b/tools/setup_check.ps1
@ -1,8 +1,15 @@
-# CI Server R1.03 - read-only setup check
+# CI Server R1.05 / R1.03 - read-only setup check
-# Compares a machine with the Windows settings required by CI Server Setup (IM 36K01C10-01EN §2.1.2)
+# Compares a machine with the Windows settings required by CI Server Setup (IM 36K01C10-01EN §1.3.2, §2.1.2)
-# and the IT security state described in the Security Guide (IM 36K01C30-01EN §2.2, §3.2).
+# and the IT security state described in the Security Guide (IM 36K01C30-01EN §2.2, §3.2, §3.5.4).
 # R1.05 rules: 5th editions (Feb. 2026); R1.03 rules: 3rd editions (Sep. 2023).
 # Changes nothing. Run in Windows PowerShell 5.1; some checks need an elevated session.
-# Usage: powershell -NoProfile -ExecutionPolicy Bypass -File tools\setup_check.ps1
+# Usage: powershell -NoProfile -ExecutionPolicy Bypass -File tools\setup_check.ps1 [-Version 1.05.00|1.03.00]
 param(
    [ValidateSet('1.05.00', '1.03.00')]
    [string]$Version = '1.05.00'
 )
 $isR103 = ($Version -eq '1.03.00')
 "Target: CI Server R$Version"
 $results = New-Object System.Collections.Generic.List[object]
 function Add-Result($area, $check, $expected, $actual, $ok) {
@ -19,8 +26,8 @@ $ci = $null
 foreach ($k in 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*', 'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*') {
    foreach ($i in (Get-ItemProperty $k -ErrorAction SilentlyContinue)) { if ($i.DisplayName -like 'CI Server R*') { $ci = $i } }
 }
-if ($ci) { Add-Result 'CI Server' 'Installed version' '1.03.00' $ci.DisplayVersion ($ci.DisplayVersion -eq '1.03.00') }
+if ($ci) { Add-Result 'CI Server' 'Installed version' $Version $ci.DisplayVersion ($ci.DisplayVersion -eq $Version) }
-else { Add-Result 'CI Server' 'Installed version' '1.03.00' 'not found' $false }
+else { Add-Result 'CI Server' 'Installed version' $Version 'not found' $false }
 $svc = Get-Service StartCIServer -ErrorAction SilentlyContinue
 if ($svc) {
    Add-Result 'CI Server' 'CI Service state' 'Running (when in use)' $svc.Status $null
@ -33,10 +40,27 @@ Add-Result 'CI Server' 'VAGW Bossd service' 'present only if installed with IT S
 # --- Operating system --------------------------------------------------------
 $os = Get-CimInstance Win32_OperatingSystem
 $osText = "$($os.Caption) build $($os.BuildNumber)"
 if ($isR103) {
    # R1.03 (IM 36K01C10-01EN 3rd ed. §1)
    $supported = @('Windows 10 Pro', 'Windows 10 Enterprise', 'Windows 10 IoT Enterprise', 'Windows Server 2016', 'Windows Server 2019', 'Windows Server IoT 2019')
    $osOk = $false; foreach ($s in $supported) { if ($os.Caption -like "*$s*") { $osOk = $true } }
-Add-Result 'Windows' 'Operating system' 'Win10 Pro/Enterprise/IoT LTSB 2016/LTSC 2019, Server 2016/2019' "$($os.Caption) build $($os.BuildNumber)" $osOk
+    Add-Result 'Windows' 'Operating system' 'Win10 Pro/Enterprise/IoT LTSB 2016/LTSC 2019, Server 2016/2019' $osText $osOk
    if ($os.Caption -like '*Windows 10 Pro*') { Add-Result 'Windows' 'Windows 10 Pro note' 'Vnet/IP drivers and IT Security Tool not supported on Win10 Pro' 'Windows 10 Pro' $null }
 }
 else {
    # R1.05 (IM 36K01C10-01EN 5th ed. §1.3.2): Server editions are listed as Standard only
    $supported = @(
        'Windows 10 (IoT )?Enterprise LTSC (2019|2021)',
        'Windows 11 (Pro|Enterprise)\b',
        'Windows 11 IoT Enterprise LTSC 2024',
        'Windows Server (IoT )?(2019|2022|2025) Standard'
    )
    $osOk = $false; foreach ($s in $supported) { if ($os.Caption -match $s) { $osOk = $true } }
    Add-Result 'Windows' 'Operating system' 'Win10 (IoT) Ent. LTSC 2019/2021, Win11 Pro/Ent., Win11 (IoT) Ent. LTSC 2024, Server (IoT) 2019/2022/2025 Standard' $osText $osOk
    $noItSec = ($os.Caption -match 'Windows Server (IoT )?2025') -or (($os.Caption -match 'Windows 11') -and ($os.Caption -notmatch 'LTSC'))
    if ($noItSec) { Add-Result 'Windows' 'Vnet/IP and IT security note' 'Vnet/IP drivers and IT Security Tool not supported on Win11 Pro/Ent. and Server 2025' $os.Caption $null }
 }
 # Visual effects: "Let Windows choose" = VisualFXSetting 0
 $vfx = Get-Reg 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\VisualEffects' 'VisualFXSetting'
@ -66,7 +90,14 @@ Add-Result 'Windows' 'Fast startup (HiberbootEnabled)' '0' $hib ($hib -eq 0)
 # Windows Defender
 $defPol = Get-Reg 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender' 'DisableAntiSpyware'
 $defSvc = Get-Service WinDefend -ErrorAction SilentlyContinue
-Add-Result 'Windows' 'Windows Defender' 'turned off by policy (use Yokogawa-approved antivirus)' "policy DisableAntiSpyware=$defPol; service=$(if ($defSvc) { $defSvc.Status } else { 'none' })" ($defPol -eq 1)
+$defText = "policy DisableAntiSpyware=$defPol; service=$(if ($defSvc) { $defSvc.Status } else { 'none' })"
 # R1.05 exceptions (IM 36K01C10-01EN 5th ed. §2.1.2, IM 36K01C30-01EN 5th ed. §3.5.4):
 # Win11 Pro 24H2 (build 26100+) must keep Defender on; Win10 LTSC 2021 (build 19044) and Win11 LTSC 2024 cannot turn it off.
 $defKeepOn = (-not $isR103) -and ($os.Caption -match 'Windows 11 Pro') -and ([int]$os.BuildNumber -ge 26100)
 $defCannotOff = (-not $isR103) -and (($os.Caption -match 'Windows 11 .*LTSC') -or (($os.Caption -match 'Windows 10 .*LTSC') -and ([int]$os.BuildNumber -eq 19044)))
 if ($defKeepOn) { Add-Result 'Windows' 'Windows Defender' 'Win11 Pro 24H2: must stay on' $defText $null }
 elseif ($defCannotOff) { Add-Result 'Windows' 'Windows Defender' 'Win10 LTSC 2021 / Win11 LTSC 2024: cannot be turned off' $defText $null }
 else { Add-Result 'Windows' 'Windows Defender' 'turned off by policy (use Yokogawa-approved antivirus)' $defText ($defPol -eq 1) }
 # Automatic Windows updates
 $au = Get-Reg 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU' 'NoAutoUpdate'
@ -107,18 +138,26 @@ foreach ($u in 'CIX_PROCESS', 'CTM_PROCESS') {
    $lu = Get-LocalUser -Name $u -ErrorAction SilentlyContinue
    Add-Result 'IT security' "Local user $u" 'exists' $(if ($lu) { "exists, enabled=$($lu.Enabled)" } else { 'missing' }) ([bool]$lu)
 }
-$itsec = Test-Path 'C:\Program Files (x86)\YOKOGAWA\IA\iPCS\Platform\Security'
+# Program folder of the IT Security Tool; IT security 3.0 also puts its GPO file and settings PDF
-Add-Result 'IT security' 'IT Security Tool installed' 'yes, when installed with ciserver-...-ITSecurity.exe' $(if ($itsec) { 'yes' } else { 'no' }) $itsec
+# under ProgramData (IM 36K01C10-01EN 5th ed. §2.1.6)
 $secPaths = @((Join-Path ${env:ProgramFiles(x86)} 'YOKOGAWA\IA\iPCS\Platform\Security'), (Join-Path $env:ProgramData 'Yokogawa\IA\iPCS\Platform\Security'))
 $found = @($secPaths | Where-Object { Test-Path $_ })
 $itsec = $found.Count -gt 0
 $v3 = Test-Path (Join-Path $env:ProgramData 'Yokogawa\IA\iPCS\Platform\Security\GPOFiles\3.0')
 $secText = if ($itsec) { "yes ($($found -join '; '))$(if ($v3) { '; IT security 3.0 files present' })" } else { 'no' }
 Add-Result 'IT security' 'IT Security Tool installed' 'yes, when installed with ciserver-...-ITSecurity.exe (or the IT security 3.0 installer)' $secText $itsec
 foreach ($p in (Get-NetFirewallProfile -ErrorAction SilentlyContinue)) {
    Add-Result 'Firewall' "Profile $($p.Name)" 'Enabled' $p.Enabled ($p.Enabled -eq $true)
 }
 $ports = @{ 'TCP 8080' = 8080; 'TCP 8443' = 8443; 'UDP 17001' = 17001; 'UDP 17101' = 17101; 'UDP 18002' = 18002 }
 # R1.05: RESTful API web server (jrstsrv.sup JRST_NETWORK_PORT), IM 36K01C30-01EN 5th ed. Table 3.2-1
 if (-not $isR103) { $ports['TCP 34597'] = 34597 }
 $allow = Get-NetFirewallRule -Direction Inbound -Action Allow -Enabled True -ErrorAction SilentlyContinue | Get-NetFirewallPortFilter -ErrorAction SilentlyContinue
 foreach ($name in $ports.Keys) {
    $proto, $num = $name.Split(' ')
    $hit = $allow | Where-Object { $_.Protocol -eq $proto -and ($_.LocalPort -contains "$num" -or $_.LocalPort -contains 'Any') }
-    Add-Result 'Firewall' "Inbound $name allowed" 'yes (web / secure web / DURM / SMDMON)' $(if ($hit) { 'yes' } else { 'no rule found' }) ([bool]$hit)
+    Add-Result 'Firewall' "Inbound $name allowed" 'yes (web / secure web / DURM / SMDMON / RESTful API)' $(if ($hit) { 'yes' } else { 'no rule found' }) ([bool]$hit)
 }
 # --- Output --------------------------------------------------------------------