diff --git a/.claude/skills/data-access/SKILL.md b/.claude/skills/data-access/SKILL.md
index c502820..e83ca54 100644
--- a/.claude/skills/data-access/SKILL.md
+++ b/.claude/skills/data-access/SKILL.md
@@ -1,24 +1,27 @@
 ---
 name: data-access
 description: >-
-  CI Server R1.03 ACCESS Service: OPC UA, OPC DA, OPC A&E and ODBC. Use when the user wants to
-  connect CI Server to an OPC UA server (OPC UA client line, station, subscription, points,
-  certificates, node IDs, browse), let another application read CI Server data over OPC UA, OPC
-  DA or OPC A&E (CI Server as OPC server, OPC visible / read / write, port 34493, endpoints,
-  security policy, trusting client certificates, UaExpert), check why an OPC connection fails
-  (BadCertificateUntrusted, BadSecurityChecksFailed, item stays NOT INIT), configure DCOM or DCOM
-  tunnelling for OPC Classic, use ODBC / SimbaClient / SQL on datasets, or check the ODBC server
-  (odbsrv, port 1583, SSL certificate), or copy item values and timestamps into Microsoft SQL
-  Server with RDBMS data exposure (dbc.sup, DEM_CONNECTION, DBCSND, DBCDEM, DATA_EXPOSURE_DF,
-  data exposure aggregation interval AGG_INTERVAL, ITEM_VALUES, SQL login, DSS-E-FLT_SYN_ERR).
-  Sources IM 36K10L45-01EN, IM 36K10E20-01EN, IM 36K10G10-01EN ch. 10.
+  CI Server R1.05 ACCESS Service: OPC UA, OPC DA, OPC A&E, ODBC and the RESTful API. Use when
+  the user wants to connect CI Server to an OPC UA server (OPC UA client line, station,
+  subscription, points, certificates, node IDs, browse, OPC UA methods MTD_KEY / MTD_TRG,
+  OPCUAC_METHOD_CALL2_DF), let another application read CI Server data over OPC UA, OPC DA or
+  OPC A&E (CI Server as OPC server, OPC visible / read / write, port 34493, endpoints, security
+  policy, trusting client certificates, UaExpert, extended OPC UA functions for alarms, history
+  and PubSub, OPC UA Information Model Mapper, NodeSet / imported information model), check why
+  an OPC connection fails (BadCertificateUntrusted, BadSecurityChecksFailed, item stays NOT INIT,
+  certificate expiry warning), configure DCOM or DCOM tunnelling for OPC Classic, use ODBC /
+  SimbaClient / SQL on datasets, or check the ODBC server (odbsrv, port 1583, SSL certificate),
+  use the RESTful API (jrstsrv, port 34597, API key, x-api-key), or copy item values and
+  timestamps into Microsoft SQL Server with RDBMS data exposure (dbc.sup, DEM_CONNECTION, DBCSND,
+  DBCDEM, DATA_EXPOSURE_DF, data exposure aggregation interval AGG_INTERVAL, ITEM_VALUES, SQL
+  login, DSS-E-FLT_SYN_ERR). Sources IM 36K10L45-01EN, IM 36K10E20-01EN, IM 36K10G10-01EN ch. 10.
 ---
 
-# Data access: OPC, ODBC and RDBMS data exposure (R1.03; RDBMS exposure tested in R1.05 only)
+# Data access: OPC, ODBC, RESTful API and RDBMS data exposure (R1.05; first written for R1.03)
 
-Background: `knowledge/manuals/IM36K10L45-01EN.md` (ODBC, OPC DA/A&E/UA client and server,
-setup files), `IM36K10E20-01EN.md` (Engineering Module forms, certificates, PubSub). Equipment
-lines/stations/points in general: skill `equipment`.
+Background: `knowledge/manuals/IM36K10L45-01EN.md` (ODBC, RESTful API, OPC DA/A&E/UA client and
+server, setup files), `IM36K10E20-01EN.md` (Engineering Module forms, certificates, Information
+Model Mapper, PubSub). Equipment lines/stations/points in general: skill `equipment`.
 
 Rules:
 - Run `system-check` first; follow the user's chosen way of working.
@@ -26,20 +29,30 @@ Rules:
   common name) and let the user trust it (Engineering Module or moving the file); do not move
   certificate files yourself.
 - Making items OPC visible / writable exposes them to every OPC client on the network: only
-  with the user's approval, and prefer read-only.
+  with the user's approval, and prefer read-only. The same applies to the RESTful API (keep its
+  read-only mode, the product default, unless the user decides otherwise).
 - Never connect a CI Server OPC **DA or A&E** client to the same node's (or a DURM-connected
-  node's) DA/A&E server: deadlock (manual §5.3). The OPC **UA** loopback is fine.
-- Changing `opxsys.sup`, `opxuas.sup`, `odbsrv.sup` or `ServerConfig.xml` needs admin rights and
-  a restart: hand it to the user (skill `portal-setup`, task `change-setup-file.md`).
+  node's) DA/A&E server: deadlock (IM 36K10L45 5th ed. §6.3). The OPC **UA** loopback is fine.
+- **Extended OPC UA functions are off by default since R1.04.** The OPC UA server offers only
+  Data Access and methods unless `OPXUAS_ENABLE_EXTENDED_FUNC = YES` in `opxuas.sup` (needed for
+  Alarms & Conditions, HistoryRead and PubSub); the OPC UA client receives no alarms unless
+  `OPXC_ENABLE_EXTENDED_FUNC = YES` in its `<process>.sup`. Both are `NO` on the R1.05 test
+  server (verified 2026-10-08). Source: IM 36K10L45 5th ed. ch. 11 intro, §10.4, §10.11,
+  §11.6.2, App. 1.3.
+- Changing `opxsys.sup`, `opxuas.sup`, `<process>.sup`, `odbsrv.sup`, `jrstsrv.sup` or
+  `ServerConfig.xml` needs admin rights and a restart: hand it to the user (skill
+  `portal-setup`, task `change-setup-file.md`).
 - The same applies to `dbc.sup` (RDBMS data exposure). SQL Server changes (mixed mode, logins,
   jobs) are on another system: only with the user's and the SQL Server owner's agreement.
 
 | Task | File | Status |
 |---|---|---|
-| OPC UA client to an OPC UA server (sample: loopback to CI Server's own server): line, station, subscription, points, certificate exchange, node IDs, browse via dataset | `tasks/opcua-client.md` | verified |
-| Make CI Server data available to OPC clients (OPC visible / Read / Write); CI Server OPC UA server endpoints, node IDs, certificates | `tasks/opcua-client.md` §1, §5 | verified (UA); DA/A&E from docs |
-| Read-only checks: ACCESS processes, ports, OPC UA server config and PKI, ODBC server state | `tasks/access-checks.md` | verified |
+| OPC UA client to an OPC UA server (sample: loopback to CI Server's own server): line, station, subscription, points, certificate exchange, node IDs, browse via dataset | `tasks/opcua-client.md` | verified on R1.03 and R1.05 (loopback re-tested 2026-10-08) |
+| Make CI Server data available to OPC clients (OPC visible / Read / Write); CI Server OPC UA server endpoints, node IDs, certificates | `tasks/opcua-client.md` §1, §5 | verified on R1.03 (UA); DA/A&E from docs |
+| Read-only checks: ACCESS processes, ports (34493, 1583, 34597), OPC UA server config and PKI, extended functions, certificate validity, ODBC server state | `tasks/access-checks.md` | verified on R1.05 (2026-10-08) |
+| OPC UA client methods (`MTD_*` object, method form, `CIX_UAC_MTD` point) and R1.03 → R1.04 method upgrade | `tasks/opcua-client.md` §7 | from docs |
 | OPC DA / A&E client and server, DCOM, DCOM tunnelling | L45 summary §3–§5 | from docs (DA loopback not allowed) |
-| ODBC with SimbaClient | L45 summary §1 | from docs; ODBC server not running on the test system (ISS-008) |
-| OPC UA alarms (external alarms), methods, PubSub | L45 §6, E20 §2–§4 | from docs |
+| ODBC with SimbaClient | L45 summary §1 | from docs; ODBC server not running on the R1.03 and R1.05 test systems (ISS-008) |
+| RESTful API (`jrstsrv`, port 34597, API key, functions) | L45 summary §9 | from docs; port and setup keywords verified on R1.05 |
+| OPC UA alarms (external alarms), model change events, PubSub, imported information model / Information Model Mapper | L45 summary §6–§7, E20 summary §2–§5 | from docs |
 | RDBMS data exposure to SQL Server: SQL login, `dbc.sup` `DEM_CONNECTION`, `DATA_EXPOSURE_DF` (filter syntax), item aggregation interval, checks, table behaviour, SQL-side retention | `tasks/rdbms-exposure.md` | tested in R1.05 only (`ITEM_VALUES`); `ITEM_HISTORY` / `ITEM_INPUTS` not tested |
diff --git a/.claude/skills/data-access/tasks/access-checks.md b/.claude/skills/data-access/tasks/access-checks.md
index 0284b1a..7f45add 100644
--- a/.claude/skills/data-access/tasks/access-checks.md
+++ b/.claude/skills/data-access/tasks/access-checks.md
@@ -1,23 +1,26 @@
 ---
-task: Read-only checks of ACCESS Service (OPC UA server, OPC clients, ODBC server)
-version: R1.03
-source: IM 36K10L45-01EN §1–§3, §6, §9, §10; practiced on the test system 2026-10-01
-status: verified
+task: Read-only checks of ACCESS Service (OPC UA server, OPC clients, ODBC server, RESTful API)
+version: R1.05 (first written for R1.03)
+source: IM 36K10L45-01EN 5th ed. (Feb. 2026) §1–§3, §4.2, §7, §10, §11; IM 36K10E20-01EN 4th ed. §2.2; practiced on the R1.03 test system 2026-10-01; re-checked read-only on the R1.05 test server 2026-10-08
+status: verified on R1.05 (2026-10-08, read-only checks below); R1.03 results kept where marked
 ---
 
 # ACCESS Service checks (read-only)
 
-| Check | How | Test system result |
+| Check | How | Result (R1.05 test server 2026-10-08 unless marked) |
 |---|---|---|
-| Processes | `tasklist` → `opxuas.exe` (UA server), `opxuac.exe` (one per OPC UA line + `opxuac_mon`), `opxdas12.exe` / `opxaes.exe` (only while a client is connected), `opxdac.exe`/`opxaec.exe` (per line); `durwfp -p <name> -t 0` → 0 = attached | `opxuas`, `opxuac` (`OPXUAC_MON`) running |
-| Ports | `netstat -ano` LISTENING: 34493 (OPC UA server), 1583 (ODBC), 135 (DCOM) | 34493 yes, 1583 **no** |
-| Start log | `%TLS_LOG_PATH%\ci_start.log`, `umhlog.log` | `InitializeSslCtx(): SSL_CTX_use_certificate_chain_file() failed` + `Process ODBSRV exited unexpectedly` = ODBC server cannot load its certificate (ISS-008) |
-| ODBC settings | `tls\sup\odbsrv.sup` (`PORT`, `USESSL`), certificate `%TLS_ROOT_PATH%\tls\pki\odbsrv\SampleServerCertificate.pem` + key | `USESSL YES`, folder missing |
-| OPC UA server settings | `tls\sup\opxuas.sup`; endpoints and user tokens in `tls\exe\ServerConfig.xml` (ignore commented XML) | Endpoint `opc.tcp://[NodeName]:34493`; Basic256Sha256 / Aes128_Sha256_RsaOaep / Aes256_Sha256_RsaPss with Sign or SignAndEncrypt; anonymous, user/password, certificate tokens on |
-| OPC UA certificates | `%TLS_ALLUSERS_PATH%\pki\opxuas\pkiserver\{own,trusted,rejected,issuers}`; client `…\pki\opxuac\pkiclient\{own,trusted,rejected,deleted,issuers}`; dataset `OPCUAC_PKI_CERTIFICATES_DF` | Server own `ciserveruaserver.der` |
-| OPC Classic settings | `tls\sup\opxsys.sup` (tabs Alarm and Event Client, Data Access Server, Alarm & Event Server) | Defaults; `OPXAEC_SAFE_CON NO` |
-| OPC UA client config | export `OPCUAC_LINE_DF`, `…_STATION_DF`, `…_SUBSCRIPTION_DF`, `…_POINT_DF` | Only the sample loopback |
-| Logs | `%TLS_LOG_PATH%\OPXUAS.log`, `OpxUas_Sdk*.log`, `<UA client process>.log` | |
+| Processes | `tasklist` → `opxuas.exe` (UA server), `opxuac.exe` (one per OPC UA line + `opxuac_mon`), `opxdas12.exe` / `opxaes.exe` (only while a client is connected), `opxdac.exe`/`opxaec.exe` (per line), a `javaw.exe` for the RESTful API server; `durwfp -p <name> -t 0` → 0 = attached | `opxuas`, `opxuac` (`OPXUAC_MON`) running; no `odbsrv` (same on R1.03) |
+| Ports | `netstat -ano` LISTENING: 34493 (OPC UA server), 1583 (ODBC), 34597 (RESTful API, R1.04+), 135 (DCOM) | 34493 yes, 34597 yes, 135 yes, 1583 **no** (R1.03: same, no 34597) |
+| Start log | `%TLS_LOG_PATH%\ci_start.log`, `umhlog.log` | `InitializeSslCtx(): SSL_CTX_use_certificate_chain_file() failed` + `Process ODBSRV exited unexpectedly` = ODBC server cannot load its certificate (ISS-008; R1.03 and R1.05) |
+| ODBC settings | `tls\sup\odbsrv.sup` (`PORT`, `USESSL`), certificate `%TLS_ROOT_PATH%\tls\pki\odbsrv\SampleServerCertificate.pem` + key | `odbsrv.sup` identical to R1.03, `USESSL YES`, folder missing |
+| OPC UA server settings | `tls\sup\opxuas.sup`; endpoints and user tokens in `ServerConfig.xml` — R1.05: `%TLS_SAV_PATH%\ServerConfig.xml` (R1.03: `%TLS_ROOT_PATH%\tls\exe`; ISS-081); ignore commented XML | Endpoint `opc.tcp://[NodeName]:34493`; Basic256Sha256 / Aes128_Sha256_RsaOaep / Aes256_Sha256_RsaPss with Sign or SignAndEncrypt; anonymous, user/password, certificate tokens on (unchanged from R1.03; the R1.05 file only adds SDK sections) |
+| Extended OPC UA functions | `findstr EXTENDED_FUNC` in `opxuas.sup` and in the client's `<process>.sup` (template `epauac_eqp.sup`) | `OPXUAS_ENABLE_EXTENDED_FUNC = NO`, `OPXC_ENABLE_EXTENDED_FUNC = NO` (product defaults): no OPC UA alarms, HistoryRead or PubSub until set to YES |
+| OPC UA certificates | `%TLS_ALLUSERS_PATH%\pki\opxuas\pkiserver\{own,trusted,rejected,issuers}`; client `…\pki\opxuac\pkiclient\{own,trusted,rejected,deleted,issuers}`; dataset `OPCUAC_PKI_CERTIFICATES_DF` | Server own `ciserveruaserver.der`; client own `<host>_OPXUAC_MON.der`; server `rejected` absent until the first rejection |
+| Certificate validity | `certutil -dump <file>.der` and look at `NotAfter` | Both own certificates valid 5 years from installation. The OPC UA client warns in the Historical Alarm Overview and the UMH message log before a client or server certificate expires (IM 36K10E20 4th ed. §2.2); lead time = hidden keyword `OPXC_CERT_EXP_PERIOD_WARN`, 2 months in `epauac_eqp.sup` |
+| OPC Classic settings | `tls\sup\opxsys.sup` (tabs Alarm and Event Client, Data Access Server, Alarm & Event Server) | Defaults; `OPXAEC_SAFE_CON NO`; new in R1.05: `OPXAES_DIR_ALM = YES` (A&E server, "Direct" alarm events; not in the manual, ISS-085) |
+| OPC UA client config | export `OPCUAC_LINE_DF`, `…_STATION_DF`, `…_SUBSCRIPTION_DF`, `…_POINT_DF`, `OPCUAC_METHOD_CALL2_DF` | R1.03: only the sample loopback. R1.05: dataset structure of line, station, subscription and point unchanged |
+| RESTful API settings | `tls\sup\jrstsrv.sup`: `JRST_NETWORK_PORT` (34597), `JRST_READ_ONLY_MODE` (product default YES), `JRST_MAX_RECORDS` (default 100), `JRST_USE_TWO_WAY_SSL` (NO), `JRST_USER_CACHE_TIME` (600 s), `JRST_CUSTOM_DATASETS`; API keys in dataset `API_KEYS_DF` (export without records in reports) | Keywords as in IM 36K10L45 5th ed. §4.2.1; compare the active values with the `!DEFAULT` block |
+| Logs | `%TLS_LOG_PATH%\OPXUAS.log`, `OpxUas_Sdk*.log`, `<UA client process>.log` | `OPXUAS.log`, `OpxUas_Sdk*.log`, `OPXUAC_MON.log` present |
 
 Fixing the ODBC server (only if ODBC is licensed and wanted; admin): place a certificate and key
 with the names above in `%TLS_ROOT_PATH%\tls\pki\odbsrv\`, or set `USESSL = NO` in `odbsrv.sup`
diff --git a/.claude/skills/data-access/tasks/opcua-client.md b/.claude/skills/data-access/tasks/opcua-client.md
index dd0abdc..fbf7ddb 100644
--- a/.claude/skills/data-access/tasks/opcua-client.md
+++ b/.claude/skills/data-access/tasks/opcua-client.md
@@ -1,8 +1,8 @@
 ---
 task: OPC UA client to an OPC UA server by quick load (loopback to CI Server's own OPC UA server)
-version: R1.03
-source: IM 36K10L45-01EN §9, §10; IM 36K10E20-01EN §2; practiced on CI-Eng-Sample 2026-10-01 (station CIENG_UA; full remove/reload; point also configured in the Engineering Module by the user and compared)
-status: verified
+version: R1.05 (first written for R1.03)
+source: IM 36K10L45-01EN 5th ed. (Feb. 2026) §10, §11; IM 36K10E20-01EN 4th ed. (Feb. 2026) §2; practiced on CI-Eng-Sample 2026-10-01 on R1.03 (station CIENG_UA; full remove/reload; point also configured in the Engineering Module by the user and compared)
+status: verified on R1.03 (§1–§6). R1.05 (2026-10-08, read-only): line/station/subscription/point dataset definitions identical to R1.03, PKI folders and client setup files checked; loopback re-tested on R1.05 2026-10-08 with the reduced sample load (certificate exchange as in §4, done by the user; COMM_OK 1, SRV_STATE 0, LEVEL_COPY follows TANK1.LEVEL; removed afterwards), the new form fields were confirmed in the installed form definitions (point form `READ_NODE_INFO` / `REBROWSE`; method form node ID type, parent object node ID, manual arguments, no process-area field), the forms themselves not opened. §7 (methods) from docs.
 ---
 
 # OPC UA client to an OPC UA server
@@ -45,13 +45,25 @@ These flags also apply to the OPC DA and A&E servers.
    ```
    "CIENG_UA_LINE","CI-Eng-Sample OPC UA loopback line","OPXCIENG"
    ```
+   The process reads `tls\sup\<process>.sup` (here `opxcieng.sup`), else the template
+   `epauac_eqp.sup` (IM 36K10L45 5th ed. §10.11; the R1.03 manual named a non-existent
+   `opxuac.sup`, ISS-084). On the R1.03 test system `opxcieng.sup` appeared as an exact copy of
+   the template. R1.05 template changes (verified 2026-10-08, ISS-083): new
+   `OPXC_ENABLE_EXTENDED_FUNC` (NO; YES needed for OPC UA alarms), `OPXC_BASE_MODEL_CHANGE_EVENT`
+   (NO), `OPXC_DISABLE_SAV_FILE` (NO), `OPXC_ALARM_TIME_ATTRIBUTE`, hidden
+   `OPXC_CERT_EXP_PERIOD_WARN` (2 months), and `OPXC_SERVICE_CALL_TIME_OUT` 60 s (manual: 10 s).
+   A per-process file copied from R1.03 lacks these keywords, so their defaults apply.
 2. **Station** (`OPCUAC_STATION_DF`), **subscription** (`OPCUAC_SUBSCRIPTION_DF`, name
    `<station>:<subscription>`), **points** (`OPCUAC_POINT_DF`, name `<station>:<point>`) —
    see `14_opcua_station_df.qli`:
    - Station: `LINE`, `USER_ANONYMOUS` 1 (or `USER_NAME`/`USER_PASSWORD`),
      `MSG_SECURITY_01_MODE` `SignAndEncrypt`, `MSG_SECURITY_01_POLICY` `Basic256Sha256`,
-     `SERVER_01_ENDPOINT` `opc.tcp://localhost:34493`, `STATUS_ITEM` (Boolean item, 1 =
-     connected). `SERVER_01_NAME`/`_URI` may stay empty.
+     `SERVER_01_ENDPOINT` `opc.tcp://localhost:34493`, `STATUS_ITEM` (1 = connected; a Boolean
+     item worked on R1.03). `SERVER_01_NAME`/`_URI` may stay empty. The R1.05 OPC Interface
+     manual (IM 36K10E20 4th ed. §2.1.2) lists states 0–5 for this item (0 preparing,
+     1 connected, 2 comm error/reconnecting, 3 connect failed, 4 server shutdown received,
+     5 connection recreated) while IM 36K10L45 §10.9.2 still calls it Boolean; not re-tested on
+     R1.05 (ISS-080). An Integer item shows all states.
    - Subscription: `REQUESTED_PUBLISH_INTERVAL` 1000.
    - Point: `SUBSCRIPTION`, `EXTERNAL_RELATION` (`Input`, `Output`, `Input + Output`),
      `OPC_NAMESPACE` (namespace **URI**, not index), `OPC_NODE_ID_TYPE` (`STRING`, `NUMERIC`,
@@ -94,7 +106,26 @@ a filter; start with an empty path, then `Objects`:
 ```
 
 Each record shows display name, namespace URI and node ID (inside `OPC_TAG_INFO`). Deeper
-paths were not found yet (`Objects.CI-Eng-Sample` returned nothing).
+paths were not found yet on R1.03 (`Objects.CI-Eng-Sample` returned nothing).
+
+R1.05: `OPCUAC_TAG_DF` (and `OPCUAC_TAG_CMPN_DF`) have two new Boolean fields, `REBROWSE`
+(ask the server again) and `READ_NODE_INFO` (read node attributes while browsing; switching it
+off is faster on slow links) (installed `opcuac_tag_df.dss`, verified 2026-10-08; not tried).
+The point form has the matching *Read additional node information* check box, and F5 in the
+expanded *Browse path* list rebrowses (IM 36K10E20 4th ed. §2.1.5).
+
+**Data types (IM 36K10L45 5th ed. §10.3.4, from docs):** UInt32, Int64 and UInt64 map to Real
+(no negatives for unsigned, no decimals), DateTime/UtcTime to String in the form
+`YYYY-MM-DDThh:mm:ss.sssZ`, ExtensionObject only for EURange / EngineeringUnits, enumerations as
+their Int32 value; one array element per point. A value that cannot be converted is logged and
+the item gets status Bad.
+
+**Model change events (IM 36K10L45 5th ed. §10.5, from docs):** the client reacts to the
+server's `GeneralModelChangeEvent` (node or reference added: the point is recreated; deleted: the
+item goes offline; external alarms are refreshed with ConditionRefresh). The coarse
+`BaseModelChangeEvent` (recreate everything) is handled only with
+`OPXC_BASE_MODEL_CHANGE_EVENT = YES`. Events within 10 s are handled once; the server must
+support Read and Browse.
 
 ## 4. Certificate exchange (first connection; the user does it)
 
@@ -116,6 +147,11 @@ again (verified: reload connected within 5 s without a new exchange). For an ext
 its certificate arrives the same way; the client certificate
 (`…\pkiclient\own\certs\<host>_<PROCESS>.der`) must be trusted on that server.
 
+From R1.05 the client warns in the Historical Alarm Overview and the UMH message log before its
+own or the server's certificate expires (IM 36K10E20 4th ed. §2.2; lead time
+`OPXC_CERT_EXP_PERIOD_WARN`, 2 months in the installed template). The own certificates made at
+installation were valid for 5 years on the R1.05 test server (verified 2026-10-08).
+
 ## 5. Check
 
 - `itmval -g -n CI-Eng-Sample.UA.COMM_OK` → 1; `UA.SRV_STATE` → 0 status 9;
@@ -128,3 +164,31 @@ its certificate arrives the same way; the client certificate
 
 Items (`76_`), then points, subscription, station (`77_`), then the line (`78_`, stops the
 client process). Reset the OPC flags only if they were not there before.
+
+## 7. Calling a method on an external OPC UA server (R1.04+, from docs)
+
+Source: IM 36K10L45 5th ed. §10.6, App. 1.3–1.4; IM 36K10E20 4th ed. §2.1.6. Not practiced.
+Installed on R1.05 (verified 2026-10-08): dataset `OPCUAC_METHOD_CALL2_DF`, loader
+`opcuac_method_u0104`, AOG displays `AOG_UAC_Method_Demo`, `AOG_UAC_Method_Call`,
+`AOG_UAC_MethodArg_Call(2)` with their symbols.
+
+1. **Class** for the method object (sample Java class `UAC_MTD_JBASE`): attribute `MTD_KEY`
+   (holds the method name) and signals `MTD_TRG` (0 idle/done, 1 call, 2 failed), `MTD_RET`
+   (result code as text; its quality holds the numeric code), `MTD_IN_ARG_0…` and
+   `MTD_OUT_ARG_0…` (at most 10 each, same order and types as on the server). These names are
+   reserved in that class. Use a class with a unique name per method object (App. 1.4).
+2. **Method** under the station (Engineering Module *Methods → Add method*, dataset
+   `OPCUAC_METHOD_CALL2_DF`, name `<station>:<method>`): `OPC_NAMESPACE`, `OPC_NODE_ID_TYPE`,
+   `OPC_NODE_ID`. If the server does not browse its method nodes: parent object node ID by hand
+   (`MANUAL_OBJ_OPC_NODE_ID`, `OBJ_OPC_NAMESPACE`, `OBJ_OPC_NODE_ID_TYPE`, `OBJ_OPC_NODE_ID`) and
+   argument types by hand (`MANUAL_ARGUMENT_CONFIGURATION`, `ARGUMENT_IN_n_TYPE` / `…OUT…`).
+3. **Point**, one per method: *Input + Output*, namespace `CIX_UAC_MTD`, type STRING, node ID
+   `CIX_UAC_MTD`; connect it to the object's `MTD_TRG` signal (*Connected I/O point*). Set
+   `MTD_KEY` to the method name. The process area goes on `MTD_TRG` (the method form no longer
+   has one). `MTD_TRG` shows status UPD_OFFLINE.
+4. **Symbol and display** for the class (see the AOG demo display), then trigger from there.
+
+Upgrade from R1.03 (App. 1.3): R1.03 methods called through dataset fields
+(`OPCUAC_METHOD_CALL_IN_DF` / `…_OUT_DF`, both gone in R1.05) stop working. Rebuild the class
+with the `MTD_*` members (*Extended reset enabled*, then reset), rebuild symbols and displays,
+and re-save (or copy and re-add) any method with String or Boolean input arguments.
diff --git a/.claude/skills/data-access/tasks/rdbms-exposure.md b/.claude/skills/data-access/tasks/rdbms-exposure.md
index d24817f..b8dda57 100644
--- a/.claude/skills/data-access/tasks/rdbms-exposure.md
+++ b/.claude/skills/data-access/tasks/rdbms-exposure.md
@@ -11,7 +11,9 @@ status: tested in R1.05 only
 Edition on a separate domain-joined host). Not re-tested on R1.03 or on CI-Eng-Sample (user
 decision 2026-10-02). On the R1.03 development machine the files `dbc.sup`,
 `data_exposure_df.dss` and `item_df.dss` were checked read-only and match what is described
-here (`dbc.sup` is identical in R1.03 and R1.05).
+here (`dbc.sup` is identical in R1.03 and R1.05 apart from the site's `DEM_CONNECTION` line;
+`data_exposure_df.dss` and `item_df.dss` identical; re-checked read-only on the R1.05 test
+server 2026-10-08).
 
 **Changes live configuration on two systems** (SQL Server and CI Server): follow the user's
 chosen way of working. SQL Server changes on a shared server need the owner's agreement.
diff --git a/.claude/skills/equipment/SKILL.md b/.claude/skills/equipment/SKILL.md
index d4d824d..3ad8c1f 100644
--- a/.claude/skills/equipment/SKILL.md
+++ b/.claude/skills/equipment/SKILL.md
@@ -1,16 +1,21 @@
 ---
 name: equipment
 description: >-
-  CI Server R1.03 EQUIPMENT Service: lines, stations, scan types, I/O points and conversion
+  CI Server R1.05 EQUIPMENT Service: lines, stations, scan types, I/O points and conversion
   types. Use when the user wants to connect CI Server to a PLC, RTU or other device (Modbus
   TCP/RTU, STARDOM FCX, FA-M3, DNP3, IEC 60870-5-104, IEC 61850, MQTT, OPC …), define or
   remove a line, station, scan type or point, connect an item to an I/O address, set a station
   off-scan or suppress outputs, add a station communication status item, run CI Server as a
   Modbus slave, force a faster scan (eqpfrcscn), check equipment statistics or use the
-  equipment debugger (eqpdbg). Sources IM 36K10L40-01EN, IM 36K10L41-01EN, IM 36K10C10-01EN §4.1.
+  equipment debugger (eqpdbg), or work with the IEC 60870-5-104 / IEC 61850 EQT managers
+  (eqt104, eqt850, eqtdbg, eqtfrcscn, IEC 61850 report control blocks, upgrade from R1.03).
+  Sources IM 36K10L40-01EN, IM 36K10L41-01EN, IM 36K10C10-01EN §4.1.
 ---
 
-# Equipment (R1.03)
+# Equipment (R1.05)
+
+Re-checked on R1.05 on 2026-10-08 (read-only): Modbus datasets, setup files and tools are
+identical to R1.03. IEC 60870-5-104 and IEC 61850 now run as **EQT** managers (see below).
 
 Background: `knowledge/manuals/IM36K10L41-01EN.md` (line types, station parameters,
 conversion types, Modbus, driver table), `IM36K10L40-01EN.md` (forced scan, statistics,
@@ -24,12 +29,18 @@ Rules:
 - Outputs write to real devices: never write to a production station's output points without
   the user's explicit approval.
 - `eqpdbg`: only the read-only actions (see L40 summary) unless the user approves.
+- IEC 104 and IEC 61850 lines (R1.04 and later) run under an `EQT<name>` manager (`eqt104`,
+  `eqt850`, started by `etaman`). `eqpdbg` and `eqpfrcscn` only reach `EQP*` managers; for EQT
+  managers use `eqtdbg` (default process `EQT`, same menu and same read-only actions) and
+  `eqtfrcscn` (template `tls\tpl\eqtfrcscn.tpl`). The manual does not describe these tools
+  (ISS-078).
 
 | Task | File | Status |
 |---|---|---|
-| Modbus TCP station by quick load: line, station, scan type, points, connected items; test, off-scan, remove | `tasks/modbus-station.md` | verified |
+| Modbus TCP station by quick load: line, station, scan type, points, connected items; test, off-scan, remove | `tasks/modbus-station.md` | verified (R1.03; re-tested on R1.05 2026-10-08) |
 | CI Server as Modbus slave (mirror `eqpmdcmem` + `eqpmdcslvtcp`) | `tasks/modbus-station.md` §1 | verified (by hand and via start file after a restart) |
 | Read-only equipment manager status with `eqpdbg` | `system-management` task `tuning-checks.md` | verified |
 | Forced scan (`eqpfrcscn`), hourly statistics (`eqpiostat`) | L40 summary | from docs (statistics empty, ISS-021) |
 | OPC UA client lines/stations/points (also OPC DA/A&E) | skill `data-access`, task `opcua-client.md` | verified (OPC UA loopback) |
 | Other protocols | L41 summary §3.8–3.40 | from docs (no hardware) |
+| IEC 61850 / IEC 104 on R1.04 and later: EQT managers, report control blocks, upgrade from R1.03 | L41 summary §3.32 and App. 1 | from docs; installed files checked on R1.05 |
diff --git a/.claude/skills/equipment/tasks/modbus-station.md b/.claude/skills/equipment/tasks/modbus-station.md
index 2f59f02..da1794f 100644
--- a/.claude/skills/equipment/tasks/modbus-station.md
+++ b/.claude/skills/equipment/tasks/modbus-station.md
@@ -1,8 +1,8 @@
 ---
 task: Modbus TCP station by quick load (line, station, scan type, points, items)
-version: R1.03
+version: R1.05 (first written for R1.03)
 source: IM 36K10L41-01EN §2, §3.1–3.2, §3.6–3.7; IM 36K10C10-01EN §4.1; practiced on CI-Eng-Sample 2026-09-30
-status: verified
+status: verified on R1.03 (2026-09-30); on R1.05 the datasets, setup files and start scripts were checked identical (2026-10-08, read-only), re-tested on R1.05 2026-10-08 with the reduced sample load on the shared test server (setpoint 1234 read back, COMM_OK 1, eqpdbg slave GOOD; mirror started for the test only; everything removed afterwards)
 ---
 
 # Modbus TCP station by quick load
@@ -24,7 +24,9 @@ CI Server ships a Modbus slave "mirror" that needs no hardware:
 Started by hand from a normal prompt they run until logoff or CI Server restart. To start
 them with CI Server, an administrator copies `examples/CI-Eng-Sample/equipment/
 eqpciengslv_start.cmd` and `_stop.cmd` to `%TLS_ROOT_PATH%\tls\com`: `equipment_start.cmd`
-runs every `eqp*start.cmd` there.
+runs every `eqp*start.cmd` there. On R1.05 (checked 2026-10-08) it also runs `eqt*start.cmd`
+and, on the host node, every `?*_equipment_start.cmd` (with `?*_equipment_stop.cmd` called
+from `equipment_stop.cmd`), which is a cleaner hook for such extensions.
 
 ## 2. Line (`MODBUS_LINE_DF`)
 
@@ -112,7 +114,7 @@ on-scan (output method *On change and connect*).
    and `tls\sav` files.
 4. The status item and section with the other items.
 
-## Test system (2026-09-30)
+## Test system (R1.03, 2026-09-30)
 
 Full cycle on CI-Eng-Sample: loaded, `SETPOINT` 1234/4321/2468 and `CMD` 1/0 read back
 through Modbus on `READBACK`/`FEEDBACK`, off-scan/on-scan checked, removed (manager stopped,
diff --git a/.claude/skills/installation-security/SKILL.md b/.claude/skills/installation-security/SKILL.md
index 5b349fb..b2b52be 100644
--- a/.claude/skills/installation-security/SKILL.md
+++ b/.claude/skills/installation-security/SKILL.md
@@ -1,15 +1,20 @@
 ---
 name: installation-security
 description: >-
-  CI Server R1.03 installation, upgrade and Windows/IT security. Use when the user wants to
+  CI Server R1.05 installation, upgrade and Windows/IT security. Use when the user wants to
   prepare Windows for CI Server, check whether a machine meets the setup requirements, install,
-  reinstall, upgrade or uninstall CI Server, apply or extend a licence, install CI Server Remote
-  Connect, set up Vnet/IP drivers or network addresses, apply the IT Security Tool, check or
-  open firewall ports, manage the CIX_ groups and CIX_PROCESS account, or run CI Server on a
-  virtual machine. Sources IM 36K01C10-01EN and IM 36K01C30-01EN.
+  reinstall, upgrade or uninstall CI Server, merge configuration files after an upgrade
+  (automatic merge, jupgutl, upgrade report), apply or extend a licence, install CI Server Remote
+  Connect, set up Vnet/IP drivers or network addresses, apply the IT Security Tool (IT security
+  version 2.0 or 3.0), set up LAPS, check or open firewall ports, manage the CIX_ groups and
+  CIX_PROCESS account, install CI Server next to PRM, or run CI Server on a virtual machine.
+  Sources IM 36K01C10-01EN and IM 36K01C30-01EN (5th editions).
 ---
 
-# Installation and security (R1.03)
+# Installation and security (R1.05)
+
+First written for R1.03 (frozen on branch `r1.03`), re-checked against the R1.05 manuals
+(5th editions, Feb. 2026) and the R1.05 test server on 2026-10-08.
 
 Background: `knowledge/manuals/IM36K01C10-01EN.md` (Setup) and
 `knowledge/manuals/IM36K01C30-01EN.md` (Security Guide). Known issues:
@@ -20,13 +25,25 @@ Rules:
 - Installing, upgrading, changing Windows settings or IT security needs an elevated session,
   changes the machine and often needs restarts: follow the user's chosen way of working and
   confirm before each step. In *prepare only* mode, produce a checklist for the user.
-- Never copy old setup files over new ones after an upgrade: compare and merge.
+- Never copy old setup files over new ones after an upgrade: compare and merge. The R1.05
+  automatic merge does not cover every file (Setup summary §3).
+- Before a reinstall or upgrade, set the startup type of *CI Service* and *VAGW Bossd* to
+  Manual. From R1.04 VAGW Bossd is stopped and started with `vagwstarter.exe` (Setup summary §3).
+- Read paths from the `TLS_*` variables: the manuals print the default install paths, which
+  may not be where CI Server is installed (ISS-086).
+- IT security (IT Security Tool, CIX_ groups, LAPS) is **not tested** on R1.05 (from docs): the
+  R1.05 test server runs Windows Server 2025, where the tool is not supported, and it is not
+  installed. Vnet/IP, the upgrade merge and PRM are not tested either (see
+  `knowledge/r105-verification.md`).
 
 | Task | Where | Status |
 |---|---|---|
-| Check a machine against the setup and security requirements | `tasks/setup-check.md` | verified |
+| Check a machine against the setup and security requirements | `tasks/setup-check.md` | verified (R1.03; R1.05 checks run one by one) |
 | New installation (physical, VM, dual-redundant): order of work, Windows settings, Vnet/IP, install, IT security, licence | Setup summary §2 | from docs |
-| Start/stop, reinstall, upgrade (incl. HAC), extend licence, uninstall | Setup summary §3 | from docs |
+| Start/stop CI Server and VAGW Bossd, reinstall, upgrade (incl. HAC), extend licence, uninstall | Setup summary §3 | from docs |
+| Upgrade with automatic merge of configuration files (installer checkbox, `jupgutl`, merge report and conflict log) | Setup summary §3 | from docs (files and merge patterns checked on the R1.05 test server) |
 | Install CI Server Remote Connect; web ports | Setup summary §2.4 | from docs |
-| Firewall ports for CI Server and drivers | Security Guide summary §3 | from docs (web, DURM, SMDMON ports checked) |
-| IT Security Tool, user management types, CIX_ groups/accounts, change service account | Security Guide summary §2, §5 | from docs |
+| CI Server and PRM on one computer or connected | Setup summary §4 | from docs |
+| Firewall ports for CI Server and drivers | Security Guide summary §3 | from docs (web, DURM, SMDMON, RESTful API ports checked on R1.03 / R1.05) |
+| IT Security Tool (version 2.0 / 3.0), user management types, CIX_ groups/accounts, change service account | Security Guide summary §2, §5, §7 | from docs |
+| LAPS (linked domain management with IT security 3.0) | Setup summary §2.1.6, Security Guide summary §7 | from docs |
diff --git a/.claude/skills/installation-security/tasks/setup-check.md b/.claude/skills/installation-security/tasks/setup-check.md
index 268de40..428a88e 100644
--- a/.claude/skills/installation-security/tasks/setup-check.md
+++ b/.claude/skills/installation-security/tasks/setup-check.md
@@ -1,27 +1,43 @@
 ---
 task: Check a machine against the CI Server setup and security requirements
-version: R1.03
-source: IM 36K01C10-01EN §1, §2.1.2, §3.2.12; IM 36K01C30-01EN §2.2, §3.2; practiced on the test system 2026-09-30
-status: verified (2026-09-30)
+version: R1.05 (first written for R1.03)
+source: IM 36K01C10-01EN 5th ed. §1.3.2, §1.3.3, §2.1.2, §2.1.3, §3.3.15; IM 36K01C30-01EN 5th ed. §2.2.1, §3.2, §3.5.4, §3.7; practiced on the R1.03 test system 2026-09-30 and checked read-only on the R1.05 test server 2026-10-08
+status: verified on R1.03 (2026-09-30); R1.05 checks verified one by one (R1.05 test server, 2026-10-08), script itself not yet run on R1.05
 ---
 
 # Setup check (read-only)
 
 ```
 powershell -NoProfile -ExecutionPolicy Bypass -File tools\setup_check.ps1
+powershell -NoProfile -ExecutionPolicy Bypass -File tools\setup_check.ps1 -Version 1.03.00
 ```
 
-Run from the repo root, preferably elevated. Changes nothing. One line per check:
+Run from the repo root, preferably elevated. Changes nothing. The default target is R1.05
+(`-Version 1.05.00`); use `-Version 1.03.00` for an R1.03 machine. One line per check:
 `[OK]` matches the manual, `[DIFF]` differs, `[CHECK]` needs a human decision.
 
+The script must be on the machine being checked. On a server you reach only remotely, the
+user copies it there (or runs the checks below by hand); it writes nothing.
+
 ## What it checks
 
 | Area | Checks |
 |---|---|
-| CI Server | Installed version (1.03.00), CI Service state, startup type and account (`.\CIX_PROCESS`), VAGW service |
-| Windows | Supported OS, visual effects, processor scheduling, virtual memory (custom, 1.5 × RAM), power plan, fast startup, Windows Defender policy, automatic updates policy, scheduled defrag and component cleanup, .NET 3.5, DCOM authentication level, display scale, 8dot3 names, regional settings |
-| IT security | `CIX_OPERATOR`, `CIX_ENGINEER`, `CIX_MAINTENANCE`, `CIX_OPC` groups, `CIX_PROCESS` / `CTM_PROCESS` users, IT Security Tool installed |
-| Firewall | Profiles enabled; inbound allowed for TCP 8080, 8443, UDP 17001, 17101, 18002 |
+| CI Server | Installed version (1.05.00 by default), CI Service (`StartCIServer`) state, startup type and account (`.\CIX_PROCESS`), VAGW service |
+| Windows | Supported OS for the target version, visual effects, processor scheduling, virtual memory (custom, 1.5 × RAM), power plan, fast startup, Windows Defender policy (with the R1.05 exceptions), automatic updates policy, scheduled defrag and component cleanup, .NET 3.5, DCOM authentication level, display scale, 8dot3 names, regional settings |
+| IT security | `CIX_OPERATOR`, `CIX_ENGINEER`, `CIX_MAINTENANCE`, `CIX_OPC` groups, `CIX_PROCESS` / `CTM_PROCESS` users, IT Security Tool installed (program folder or the IT security 3.0 folder under ProgramData) |
+| Firewall | Profiles enabled; inbound allowed for TCP 8080, 8443, UDP 17001, 17101, 18002; on R1.05 also TCP 34597 (RESTful API) |
+
+R1.05 supported OS (IM 36K01C10 5th ed. §1.3.2), all 64-bit: Windows 10 Enterprise / IoT
+Enterprise LTSC 2019 and 2021, Windows 11 Pro and Enterprise, Windows 11 Enterprise / IoT
+Enterprise LTSC 2024, Windows Server 2019 / IoT 2019, 2022 / IoT 2022 and 2025 / IoT 2025
+(Standard). On Windows 11 Pro/Enterprise and Server 2025 the Vnet/IP drivers and the IT
+Security Tool are not supported. Windows 10 Pro/Enterprise (non-LTSC), LTSB 2016 and Server
+2016 are no longer listed.
+
+Defender (IM 36K01C10 5th ed. §2.1.2, IM 36K01C30 5th ed. §3.5.4): normally turned off by
+group policy, but it must stay on with Windows 11 Pro 24H2, and it cannot be turned off on
+Windows 10 LTSC 2021 or Windows 11 LTSC 2024. The script reports `[CHECK]` for those.
 
 ## Reading the result
 
@@ -29,23 +45,58 @@ Run from the repo root, preferably elevated. Changes nothing. One line per check
   Setup summary's Windows settings table (`knowledge/manuals/IM36K01C10-01EN.md` §2) or by
   running the IT Security Tool.
 - The script finds the firewall rules only as "some rule allows this port"; check the rule
-  scope separately for production.
+  scope separately for production. If the active profile is switched off, no rule is needed
+  and every port is open: check which profile is active (`Get-NetConnectionProfile`).
+- Listening ports (useful when there are no rules): `Get-NetTCPConnection -State Listen` and
+  `Get-NetUDPEndpoint` with the owning process. On R1.05 the RESTful API server (`jrstsrv`,
+  a `javaw` process) also listens on TCP 7073, which no manual mentions (ISS-087): do not open
+  it in the firewall.
 - Also read `%TLS_LOG_PATH%\ci_start.log` after a start: every service should report
-  `… started` and the log ends with `CI Server started`; look for `-E-` and `failed` lines.
-  The first lines show the version and build (e.g. `R1.03.00 … (r10200M)`).
+  `… started` and there should be a `CI Server started` line; look for `-E-` and `failed`
+  lines. The log keeps growing after the start (equipment messages), so the `CI Server
+  started` line is not always last. The `UMHLOGTOO` line near the top shows the version and
+  build (R1.03: `R1.03.00 … (r10200M)`, R1.05: `R1.05.00 … (r11609M)`).
 - The web ports actually used are `SECURE_PORT_NUMBER` / `NON_SECURE_PORT_NUMBER` in
-  `%TLS_ROOT_PATH%\tls\sup\jwuiisg.sup` (8443 / 8080 by default).
+  `%TLS_ROOT_PATH%\tls\sup\jwuiisg.sup` (8443 / 8080 by default); the RESTful API port is
+  `JRST_NETWORK_PORT` in `jrstsrv.sup` (34597 by default, R1.05).
+- Installed updates: `Get-HotFix`. `wmic qfe list full` (Setup App. 1.3) fails on Windows
+  Server 2025 / 24H2, where WMIC is no longer installed (ISS-088).
 - Folder rights (not in the script): setup files can hold passwords (e.g. `dbc.sup`). Check
   who can read and change them:
   `foreach ($r in (Get-Acl "$env:TLS_ROOT_PATH\tls\sup").Access) { "{0} : {1}" -f $r.IdentityReference, $r.FileSystemRights }`.
   Under Program Files, Users can read; an install outside Program Files (e.g.
-  `C:\Yokogawa\CIServer`, seen on an R1.05 system) can inherit *Authenticated Users: Modify*,
-  so any signed-in user can change setup files (ISS-061). Fixing it is a site decision (IT
-  Security Tool).
+  `C:\Yokogawa\CIServer`, as on the R1.05 test server) can inherit *Authenticated Users:
+  Modify*, so any signed-in user can change setup files (ISS-061). Fixing it is a site
+  decision (IT Security Tool).
+- A local group `RDC_GA_CLIENT` with member `CIX_PROCESS` can exist on a machine that is not
+  a dual-redundant platform and has no IT security applied (seen on R1.05). It needs no
+  action (ISS-089).
 
-## Test system result (2026-09-30)
+## R1.05 test server result (2026-10-08)
+
+Checks run one by one, read-only, then the script itself (copied to a temporary folder,
+run from an elevated session, deleted again): **12 OK, 5 CHECK, 20 DIFF**. The first run
+showed the CI Server ports as allowed: the script counted program-limited Windows rules with
+"any port" (e.g. Remote Desktop Shadow) as a match. Fixed 2026-10-08; such rules no longer count. Windows Server 2025
+Datacenter (24H2) virtual machine, domain member, CI Server R1.05.00 (r11609M) installed in
+`C:\Yokogawa\CIServer` without the IT Security Tool.
+
+- Matched: CI Service running, automatic, account `.\CIX_PROCESS`; fast startup off; High
+  performance plan; processor scheduling Programs; 8dot3 names enabled; 100 % scale; web
+  ports 8443/8080; RESTful API on 34597; DURM UDP 17001/17101 and SMDMON UDP 18002 listening.
+- Differed: Datacenter edition is not listed (only Standard); firewall profile for the
+  domain network off and no CI Server inbound rules; Defender on; automatic updates, defrag
+  and component cleanup not disabled; virtual memory not a custom size; .NET 3.5 not
+  installed; no `CIX_` groups, no `CTM_PROCESS`, no VAGW Bossd service (IT Security Tool not
+  installed and not supported on Server 2025, so IT security is **not tested** on this server).
+- `ci_start.log`: all services started; the same odbsrv SSL certificate error as on R1.03
+  (ISS-008).
+
+## R1.03 test system result (2026-09-30)
 
 Windows 10 Pro 19045 development PC without the IT Security Tool: 16 OK, 5 CHECK, 15 DIFF.
+(Run before the firewall-check fix of 2026-10-08, so "inbound allowed" lines may have counted
+program-limited "any port" rules; re-run to confirm.)
 Differences: firewall domain/private profiles off; no `CIX_` groups or `CTM_PROCESS` (IT
 Security Tool not installed; not supported on Windows 10 Pro); fast startup on; Balanced power
 plan; automatic virtual memory; Defender on; automatic updates, defrag and cleanup not
@@ -53,4 +104,4 @@ disabled. Web ports 8443/8080. `ci_start.log`: all services started, one SSL cer
 (`InitializeSslCtx(): SSL_CTX_use_certificate_chain_file() failed`): the ODBC server `odbsrv`
 has `USESSL = YES` but no certificate in `%TLS_ROOT_PATH%\tls\pki\odbsrv`, so it exits at
 start (harmless unless ODBC is used; fix in skill `data-access`, task `access-checks.md`;
-`knowledge/issues.md` ISS-008).
+`knowledge/issues.md` ISS-008). Windows 10 Pro is no longer a supported OS for R1.05.
diff --git a/.claude/skills/system-management/tasks/load-remove-records.md b/.claude/skills/system-management/tasks/load-remove-records.md
index 79ebb02..0a314b5 100644
--- a/.claude/skills/system-management/tasks/load-remove-records.md
+++ b/.claude/skills/system-management/tasks/load-remove-records.md
@@ -1,7 +1,7 @@
 ---
 task: Load and remove dataset records with dssqld (quick load)
 version: R1.03
-source: IM 36K10J10-01EN §2.9.2, §5.6; IM 36K10L45-01EN §9.10–9.11; practiced with CI-Eng-Sample 2026-09-30
+source: IM 36K10J10-01EN §2.9.2, §5.6; IM 36K10L45-01EN §10.12–10.13 (5th ed.; §9.10–9.11 in the R1.03 edition); practiced with CI-Eng-Sample 2026-09-30
 status: verified
 ---
 
diff --git a/CLAUDE.md b/CLAUDE.md
index d323fa5..b95b60e 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -60,3 +60,7 @@ The R1.05 test server is shared with other projects. Never disturb their work th
 read-only checks unless the user approves a change, never restart CI Server, never write to other
 projects' records or to live plant values, and remove anything you put on the server.
 Fixes that also apply to R1.03 can be cherry-picked onto branch `r1.03`.
+
+When re-checking a manual for R1.05, compare its full text with the R1.03 edition
+(`tools/manual_diff.py`), not just the revision table or release notes: R1.04 changes are
+often not listed there.
diff --git a/examples/CI-Eng-Sample/README.md b/examples/CI-Eng-Sample/README.md
index 57e0bf0..a622a2a 100644
--- a/examples/CI-Eng-Sample/README.md
+++ b/examples/CI-Eng-Sample/README.md
@@ -1,11 +1,15 @@
 # CI-Eng-Sample
 
 A small, invented sample project that anyone with this repo can load into a CI Server
-**R1.03** test system. Skills use its names in their examples, and every skill task is
+test system (R1.03 or R1.05). Skills use its names in their examples, and every skill task is
 re-tested against it so that no other project is needed.
 
 Built and tested on CI Server R1.03.00 (unlicensed test system), 2026-09-30; operator HMI, demo
-user and live-data feed added 2026-10-06.
+user and live-data feed added 2026-10-06. Reduced load (below) tested on R1.05.00 on a shared
+server, 2026-10-08: loads with 0 errors (the `@VERSION 1.03.00` headers are accepted).
+
+**Every test ends with the system back in its original state:** remove what was loaded, stop
+processes started for the test, undo certificate trust, delete scratch and temporary files.
 
 ## Load and remove
 
@@ -30,6 +34,25 @@ cmd /c "<repo>\examples\CI-Eng-Sample\remove.cmd"
   has passed, so the script sets a stop time one minute ahead and waits. Removing the group
   also deletes its history.
 
+### Testing on a shared server (`shared\`)
+
+For a server that other projects use, where CI Server must not be restarted:
+
+| Script | Does |
+|---|---|
+| `shared\snapshot.ps1 -Out <file>` | Read-only snapshot: record names (count, hash, `CIENG*` names) of every dataset the sample touches, file lists of `tls\com`, `sup`, `sav`, `lst`, the `pki` folders, running CI Server processes. Run before and after; compare the two files. |
+| `shared\reduced_load.cmd` | `load.cmd` without the storage groups and history bindings (`03`, `04`: need a restart), the authorization group and user `CIENG` (`08`, `08b`: a password-less user on a shared server) and the layouts/displays (shared `Layouts.xml`) |
+| `shared\test_r105.ps1` | Starts the Modbus slave mirror only for the test, checks classes, sub-items, Modbus loopback and OPC UA loopback with `itmval`, stops the mirror again |
+| `shared\reduced_remove.cmd` | Removes exactly what `reduced_load.cmd` loaded |
+| `shared\clean_dss_tmp.ps1 -Since <time>` | Deletes the `dss_*.tmp` files the test left in `%TLS_LST_PATH%` (ISS-091) |
+
+Copy the whole sample folder to a temporary folder on the server, run from there, and delete
+it afterwards. Also delete `%TLS_LOG_PATH%\OPXCIENG.log`. The OPC UA certificate exchange and
+its undo are user steps (see below); the client's own certificate `<host>_OPXCIENG.der/.pem`
+and the trusted copies stay in the `pki` folders (and in `OPCUAC_PKI_CERTIFICATES_DF`, which
+follows the files) until they are deleted; the server-side `pkiserver\rejected` folder is also
+created by the test; delete it when it is empty.
+
 ## Current contents
 
 | Name | Kind | Details |
diff --git a/examples/CI-Eng-Sample/shared/clean_dss_tmp.ps1 b/examples/CI-Eng-Sample/shared/clean_dss_tmp.ps1
new file mode 100644
index 0000000..382cf9c
--- /dev/null
+++ b/examples/CI-Eng-Sample/shared/clean_dss_tmp.ps1
@@ -0,0 +1,15 @@
+# Remove the DSS temporary files that a test session left in %TLS_LST_PATH%.
+# Each dssqld run can leave a 0-byte dss_<n>_<id>.tmp there, and loading a class leaves its source
+# text in one (verified on R1.05, 2026-10-08). Only files written since -Since are touched: 0-byte
+# files, and non-empty files that contain sample text (CIENG / CI-Eng-Sample). Files in use are skipped.
+# Usage: powershell -NoProfile -ExecutionPolicy Bypass -File clean_dss_tmp.ps1 -Since "2026-10-08T07:00:00"
+param([Parameter(Mandatory = $true)][datetime]$Since)
+$lst = $env:TLS_LST_PATH
+$f = Get-ChildItem -Path $lst -Filter 'dss_*.tmp' | Where-Object { $_.LastWriteTime -ge $Since }
+$ok = 0; $skip = 0
+foreach ($i in $f) {
+    $mine = ($i.Length -eq 0) -or (Select-String -LiteralPath $i.FullName -Pattern 'CIENG|CI-Eng-Sample' -Quiet)
+    if (-not $mine) { $skip++; continue }
+    try { Remove-Item -LiteralPath $i.FullName -ErrorAction Stop; $ok++ } catch { $skip++ }
+}
+"deleted $ok, left $skip (other content or in use)"
diff --git a/examples/CI-Eng-Sample/shared/reduced_load.cmd b/examples/CI-Eng-Sample/shared/reduced_load.cmd
new file mode 100644
index 0000000..351dbe4
--- /dev/null
+++ b/examples/CI-Eng-Sample/shared/reduced_load.cmd
@@ -0,0 +1,27 @@
+@echo off
+REM Reduced CI-Eng-Sample load for the shared R1.05 test server (2026-10-08).
+REM Skips: history group/bindings (03, 04: need a CI Server restart), auth group and user (08, 08b),
+REM layouts/displays. Run from the copied sample folder (this script lives in its shared subfolder).
+cd /d "%~dp0.."
+dssqld -i 01_section_df.qli -l 01_section_df.qlo
+dssqld -i 01b_alarm_df.qli -l 01b_alarm_df.qlo
+dssqld -i 02_item_df.qli -l 02_item_df.qlo
+dssqld -i 02b_sub_item_df.qli -l 02b_sub_item_df.qlo
+dssqld -i 05_trigger_df.qli -l 05_trigger_df.qlo
+dssqld -i 06_class_df.qli -l 06_class_df.qlo
+dssqld -i 07_object_df.qli -l 07_object_df.qlo
+dssqld -i 09_modbus_line_df.qli -l 09_modbus_line_df.qlo
+powershell -NoProfile -Command "Start-Sleep -Seconds 15"
+dssqld -i 10_modbus_station_df.qli -l 10_modbus_station_df.qlo
+dssqld -i 11_item_eqp_df.qli -l 11_item_eqp_df.qlo
+dssqld -m 12_opc_visible_df.qli -l 12_opc_visible_df.qlo
+dssqld -i 13_opcua_line_df.qli -l 13_opcua_line_df.qlo
+powershell -NoProfile -Command "Start-Sleep -Seconds 10"
+dssqld -i 14_opcua_station_df.qli -l 14_opcua_station_df.qlo
+dssqld -i 15_item_opcua_df.qli -l 15_item_opcua_df.qlo
+dssqld -m 16_item_alarm_df.qli -l 16_item_alarm_df.qlo
+powershell -NoProfile -ExecutionPolicy Bypass -File 17_printer_df.ps1
+dssqld -i 17_printer_df.qli -l 17_printer_df.qlo
+dssqld -i 18_report_df.qli -l 18_report_df.qlo
+dssqld -i 19_audit_df.qli -l 19_audit_df.qlo
+dssqld -m 19b_audit_item_df.qli -l 19b_audit_item_df.qlo
diff --git a/examples/CI-Eng-Sample/shared/reduced_remove.cmd b/examples/CI-Eng-Sample/shared/reduced_remove.cmd
new file mode 100644
index 0000000..8a05f10
--- /dev/null
+++ b/examples/CI-Eng-Sample/shared/reduced_remove.cmd
@@ -0,0 +1,21 @@
+@echo off
+REM Removes the reduced CI-Eng-Sample load (reverse of reduced_load.cmd).
+cd /d "%~dp0.."
+dssqld -r 79_remove_audit_df.qli -l 79_remove_audit_df.qlo
+dssqld -m 83a_stop_report_df.qli -l 83a_stop_report_df.qlo
+dssqld -r 83_remove_report_df.qli -l 83_remove_report_df.qlo
+dssqld -r 84_remove_printer_df.qli -l 84_remove_printer_df.qlo
+if exist "%TLS_LST_PATH%\cieng_report.txt" del "%TLS_LST_PATH%\cieng_report.txt"
+dssqld -r 76_remove_item_opcua_df.qli -l 76_remove_item_opcua_df.qlo
+dssqld -r 77_remove_opcua_station_df.qli -l 77_remove_opcua_station_df.qlo
+dssqld -r 78_remove_opcua_line_df.qli -l 78_remove_opcua_line_df.qlo
+dssqld -r 80_remove_item_eqp_df.qli -l 80_remove_item_eqp_df.qlo
+dssqld -r 81_remove_modbus_station_df.qli -l 81_remove_modbus_station_df.qlo
+dssqld -r 82_remove_modbus_line_df.qli -l 82_remove_modbus_line_df.qlo
+dssqld -r 86_remove_object_df.qli -l 86_remove_object_df.qlo
+dssqld -r 87_remove_class_df.qli -l 87_remove_class_df.qlo
+dssqld -r 88_remove_trigger_df.qli -l 88_remove_trigger_df.qlo
+dssqld -r 90b_remove_sub_item_df.qli -l 90b_remove_sub_item_df.qlo
+dssqld -r 91_remove_item_df.qli -l 91_remove_item_df.qlo
+dssqld -r 92_remove_section_df.qli -l 92_remove_section_df.qlo
+dssqld -r 93_remove_alarm_df.qli -l 93_remove_alarm_df.qlo
diff --git a/examples/CI-Eng-Sample/shared/snapshot.ps1 b/examples/CI-Eng-Sample/shared/snapshot.ps1
new file mode 100644
index 0000000..8695535
--- /dev/null
+++ b/examples/CI-Eng-Sample/shared/snapshot.ps1
@@ -0,0 +1,37 @@
+# Read-only snapshot of everything the reduced CI-Eng-Sample test can touch.
+param([string]$Out)
+$ErrorActionPreference = 'Continue'
+$w = New-Object System.Collections.Generic.List[string]
+$tmp = Join-Path $PSScriptRoot 'snapx'
+New-Item -ItemType Directory -Force -Path $tmp | Out-Null
+$ds = 'SECTION_DF','ITEM_DF','SUB_ITEM_DF','ALARM_ACK_DF','ALARM_AOI_DF','ALARM_ASA_DF','TRIGGER_DF',
+      'CLASS_DF','OBJECT_DF','LINE_DF','STATION_DF','POINT_DF','MODBUS_LINE_DF','MODBUS_STATION_DF',
+      'MODBUS_SCAN_TYPE_DF','MODBUS_POINT_DF','OPCUAC_LINE_DF','OPCUAC_STATION_DF',
+      'OPCUAC_SUBSCRIPTION_DF','OPCUAC_POINT_DF','PRINTER_DEV_DF','PRINTER_DEST_DF','REPORT_DF',
+      'AUDIT_SELGRP_DF','OPCUAC_PKI_CERTIFICATES_DF'
+foreach ($d in $ds) {
+    $f = Join-Path $tmp "$d.qlo"
+    $null = & dssqld -e $f -d $d -c 2>&1
+    $names = @()
+    if (Test-Path $f) { $names = @(Import-Csv $f | ForEach-Object { $_.NAME }) | Sort-Object }
+    $sha = [BitConverter]::ToString((New-Object Security.Cryptography.SHA256Managed).ComputeHash([Text.Encoding]::UTF8.GetBytes(($names -join "`n")))).Replace('-','').Substring(0,16)
+    $mine = @($names | Where-Object { $_ -match 'CIENG|CI-Eng' })
+    $w.Add("DS $d count=$($names.Count) hash=$sha cieng=$($mine.Count) $($mine -join ';')")
+}
+Remove-Item -Recurse -Force $tmp
+$root = $env:TLS_ALLUSERS_PATH
+foreach ($sub in 'com','sup','sav','lst') {
+    foreach ($i in (Get-ChildItem -Path (Join-Path $env:TLS_ROOT_PATH "tls\$sub") -File | Sort-Object Name)) {
+        if ($sub -eq 'lst' -or $sub -eq 'sav') { $w.Add("FILE $sub\$($i.Name)") }
+        else { $w.Add("FILE $sub\$($i.Name) $($i.Length) $($i.LastWriteTime.ToString('s'))") }
+    }
+}
+foreach ($i in (Get-ChildItem -Path (Join-Path $root 'pki') -Recurse -File | Sort-Object FullName)) {
+    $w.Add("PKI $($i.FullName.Substring($root.Length)) $($i.Length)")
+}
+$exe = Join-Path $env:TLS_ROOT_PATH 'tls\exe'
+foreach ($g in (Get-Process | Where-Object { $_.Path -like "$exe*" } | Group-Object Name | Sort-Object Name)) {
+    $w.Add("PROC $($g.Name) x$($g.Count)")
+}
+$w | Set-Content -Encoding utf8 $Out
+"snapshot: $($w.Count) lines -> $Out"
diff --git a/examples/CI-Eng-Sample/shared/test_r105.ps1 b/examples/CI-Eng-Sample/shared/test_r105.ps1
new file mode 100644
index 0000000..1a06af9
--- /dev/null
+++ b/examples/CI-Eng-Sample/shared/test_r105.ps1
@@ -0,0 +1,36 @@
+# Functional test of the reduced CI-Eng-Sample load on R1.05. Starts the Modbus slave mirror only
+# for the duration of the test and stops it again.
+$P = 'CI-Eng-Sample'
+function V($n) { (& itmval -g -n "$P.$n" 2>&1 | Out-String).Trim() -replace '\s+', ' ' }
+function W($n, $v) { $null = & itmval -p -n "$P.$n" -v $v 2>&1 }
+
+"--- start Modbus slave mirror"
+$mem = Start-Process -FilePath eqpmdcmem -ArgumentList '-n','EQPMDCMEM' -WindowStyle Hidden -PassThru
+Start-Sleep 3
+$slv = Start-Process -FilePath eqpmdcslvtcp -ArgumentList '-n','EQPMDCSLVTCP','-p','5020' -WindowStyle Hidden -PassThru
+"mirror pids $($mem.Id) $($slv.Id)"
+"--- classes and sub-items"
+"COUNTER t0: $(V 'DEMO.COUNTER')"; Start-Sleep 3; "COUNTER t3: $(V 'DEMO.COUNTER')"
+W 'TANK1.LEVEL' 50; W 'TANK1.INFLOW' 120; Start-Sleep 3
+"TANK1.CALC.VOLUME (expect 100): $(V 'TANK1.CALC.VOLUME')"
+"TANK1.JFLOW.sPerMin (expect 2): $(V 'TANK1.JFLOW.sPerMin')"
+"TANK1.LEVEL.MAX: $(V 'TANK1.LEVEL.MAX')"
+"--- wait 45 s for Modbus station and OPC UA client"
+Start-Sleep 45
+W 'PLC1.SETPOINT' 1234; Start-Sleep 4
+"PLC1.READBACK (expect 1234): $(V 'PLC1.READBACK')"
+"PLC1.COMM_OK (expect 1): $(V 'PLC1.COMM_OK')"
+"--- eqpdbg slave info"
+('3', '1', '-1') -join "`n" | & eqpdbg 0 EQPCIENG 2>&1 | Select-String -Pattern 'scan status|Slave name|name|Line status|Good|requests' | Select-Object -First 12 | ForEach-Object { $_.Line.Trim() }
+"--- OPC UA loopback"
+"UA.COMM_OK: $(V 'UA.COMM_OK')"
+"UA.SRV_STATE: $(V 'UA.SRV_STATE')"
+"UA.LEVEL_COPY: $(V 'UA.LEVEL_COPY')"
+$pki = $env:TLS_ALLUSERS_PATH + '\pki'
+"client rejected: " + ((Get-ChildItem "$pki\opxuac\pkiclient\rejected" -File -ErrorAction SilentlyContinue | ForEach-Object Name) -join '; ')
+"server rejected: " + ((Get-ChildItem "$pki\opxuas\pkiserver\rejected" -File -ErrorAction SilentlyContinue | ForEach-Object Name) -join '; ')
+"--- stop mirror"
+& durstp -msk -t 10 -p EQPMDCSLVTCP 2>&1 | Out-Null
+& durstp -msk -t 10 -p EQPMDCMEM 2>&1 | Out-Null
+Start-Sleep 2
+"mirror still running: " + ((Get-Process -Id $mem.Id, $slv.Id -ErrorAction SilentlyContinue | ForEach-Object Id) -join ' ')
diff --git a/knowledge/README.md b/knowledge/README.md
index a538ea4..d4a4636 100644
--- a/knowledge/README.md
+++ b/knowledge/README.md
@@ -10,3 +10,4 @@ that area's skill (`.claude/skills/<area>/reference/`).
 | `manuals/` | One summary per manual (`IM36K….md`), written in our own words |
 | `document-map.md` | All EN manuals by IM number, with editions |
 | `version-differences.md` | What changed from R1.03 to R1.05 (manuals and installed files) |
+| `r105-verification.md` | R1.05 checks marked *not tested* and the steps awaiting user verification |
diff --git a/knowledge/issues.md b/knowledge/issues.md
index 56689a7..bb9ad38 100644
--- a/knowledge/issues.md
+++ b/knowledge/issues.md
@@ -21,12 +21,12 @@ development system (see "Test system" in `progress.md`); they do not exist on ot
 |---|---|---|---|---|---|---|
 | ISS-001 | 2026-09-30 | ITEM (`itmval`) | Writing an item with `itmval -p -n AID.WRPS.SIM.INFLOW -v 400` added the `uoff` option flag (options 0x…8a → 0x…8e). The flag stayed after writing the original value back. Meaning of `uoff` unknown; not found in the EN manuals by text search. | closed | 2026-09-30 (phase 5): IM 36K10C10 §3.5 gives the option bits: 1 blocked, 2 offline, **4 updated offline** (written by an application while offline), 8 acknowledged, **16 updated blocked**, 32 direct alarm, 64 delayed alarm. 0x8a = offline + acknowledged (+0x80, not documented); +4 = 0x8e, so `uoff` = updated offline and `ublk` = updated blocked. Matches all observations. Not yet found: how to clear the flags (probably on the next update from the station). Closed 2026-09-30 (confirmed by user). Earlier notes: writing internal sample items (`CI-Eng-Sample.*`, no station) does **not** set `uoff` (options stay 0x…88), so it is tied to station-connected items (the AID item was already `off`, its station not communicating). Still to find: meaning and how to clear it (ITEM Service IM 36K10L35/L36, Engineering Module I/O Processes IM 36K10C10). Revisit in phase 5 with a station item. 2026-09-30 later: unblocking a sample item left the flag `ublk` (after `blk` was cleared), so `u…` flags may mean "was …" (un-blocked / un-offline). Still unconfirmed. | `.claude/skills/system-management/tasks/read-write-item.md` (replace the `uoff` note under "Read the current value"); `knowledge/progress.md` row "Write an item with `itmval -p`" |
 | ISS-002 | 2026-09-30 | DATABASE (`dsschk`) | `dsschk -d ITEM_DF -v` (check only) exits 0 with no console output and nothing new in `umhlog.log`. Where results are reported is unknown. | closed | Closed 2026-09-30 (confirmed by user). 2026-09-30: `dsschk -e -v` prints a start/end line per dataset (228 checked, no problems) and logs to `umhlog.log`. Plain `dsschk` only compares copies between nodes, so it prints nothing on a single-node system. `ismchk` needs a database file name (usage: `ismchk data_base_name`), not run yet. | Create `.claude/skills/system-management/tasks/consistency-check.md` and add it to that skill's `SKILL.md`; `knowledge/manuals/IM36K10J10-01EN.md` §4.1.1 consistency tools (add where output goes); `knowledge/progress.md` row "Consistency check" |
-| ISS-003 | 2026-09-30 | DATABASE (`dssqld`) | Filtered export (`dssqld -e <out> <filter>.qli`) failed with a guessed filter syntax (`@ITEM_DF`, `@FIELD`, `@SELECT`). | closed | Closed 2026-09-30 (confirmed by user). 2026-09-30: the quick load **data** format is now known and verified (`@LANGUAGE`, `@VERSION`, `@FIELDS`, `@<DATASET>`, quoted CSV records, `\` continuation, `!` comments; IM 36K10L45 §9.11). Filter syntax found (IM 36K10L50 §3.6) and practiced, awaiting confirmation: a file with `@SELECT`, then the filter in single quotes (strings in double quotes), then `@<DATASET>`; run `dssqld -e <out> <filter>.qli`. `ITEM_HISTORY` returns nothing unless the filter names `ITEM_NAME` and a `SAMPLE_TIME` range (`SAMPLE_TIME > "dd-mm-yyyy hh:mm:ss" and SAMPLE_TIME < ...`). | `.claude/skills/system-management/tasks/export-dataset.md` section "Filtered exports"; `knowledge/manuals/IM36K10J10-01EN.md` §5.6 step 1; `knowledge/progress.md` row "Export a dataset" |
+| ISS-003 | 2026-09-30 | DATABASE (`dssqld`) | Filtered export (`dssqld -e <out> <filter>.qli`) failed with a guessed filter syntax (`@ITEM_DF`, `@FIELD`, `@SELECT`). | closed | R1.05 (2026-10-08): the quick load format section is now IM 36K10L45 5th ed. §10.13 (was §9.11). Closed 2026-09-30 (confirmed by user). 2026-09-30: the quick load **data** format is now known and verified (`@LANGUAGE`, `@VERSION`, `@FIELDS`, `@<DATASET>`, quoted CSV records, `\` continuation, `!` comments; IM 36K10L45 §9.11). Filter syntax found (IM 36K10L50 §3.6) and practiced, awaiting confirmation: a file with `@SELECT`, then the filter in single quotes (strings in double quotes), then `@<DATASET>`; run `dssqld -e <out> <filter>.qli`. `ITEM_HISTORY` returns nothing unless the filter names `ITEM_NAME` and a `SAMPLE_TIME` range (`SAMPLE_TIME > "dd-mm-yyyy hh:mm:ss" and SAMPLE_TIME < ...`). | `.claude/skills/system-management/tasks/export-dataset.md` section "Filtered exports"; `knowledge/manuals/IM36K10J10-01EN.md` §5.6 step 1; `knowledge/progress.md` row "Export a dataset" |
 | ISS-004 | 2026-09-30 | ITEM (`itmval`) | `itmval -g -a <1..5>` returns `ITM-E-WRONG_ATT` on `AID.WRPS.*` items, so reading limits is unproven. | closed | Closed 2026-09-30 (confirmed by user). On `CI-Eng-Sample.TANK1.LEVEL` (limits set) `-a 1..5` returned deadband 0, low 20, high 80, low-low 10, high-high 90. The error only occurs on items without limits. | `.claude/skills/system-management/tasks/read-write-item.md` (limits section); `knowledge/progress.md` row "Read an item with `itmval -g`" |
 | ISS-005 | 2026-09-30 | DATABASE (`dssqld`) | Loading `04_item_his_df.qli` straight after creating the storage group gave 2 errors once; three other runs were clean. Error text not captured. | closed | Added a 5 s pause in `load.cmd`. No recurrence since: every full sample reload in phases 6-12 (latest 2026-10-01) loaded `04_item_his_df.qli` with 0 errors. Closed 2026-10-01 (confirmed by user). | `examples/CI-Eng-Sample/load.cmd`; `.claude/skills/system-management/tasks/load-remove-records.md` |
 | ISS-006 | 2026-09-30 | HISTORY (`ithloahis`) | Samples dated before the start of the current storage unit were not stored (no error shown); samples after it were. Also, a new storage group stored nothing until CI Server was restarted. | closed | Closed 2026-10-01 (confirmed by user). Confirm with History Management (IM 36K10L20) in phase 9: how to load into older units, and whether a restart is really required. 2026-09-30 (phase 5): IM 36K10L35 §1.3/§5 explains the first part: event storage picks the unit by time stamp, never older than 60 units, and within the storage process's `gap_time` (ITHEEX/ITHEIX 2880 min) and, for EVENT/ITEM, `max_sample_delay` (ITHEIX 14400 min); older data needs earlier unit files (`hisdbg`, `hisrecover`, `isfrename`), `ithrecover <group> -p` and a restart. Practice in phase 9. 2026-10-01 (phase 9, verified): (1) restart **is** required — `CIENG_SCAN10S` / `CIENG_AGG` loaded at 11:54 and `CIENG_EVENT` reloaded at 11:32 stored nothing until the 12:00 restart, then stored at once. (2) The first unit of a new Event/Item or Aggregation group is dated 2 days back (= `gap_time` 2880 min), but samples loaded into that pre-restart unit (11:50, 30-Sep) were still dropped; samples inside the active unit (12:02) and inside a unit closed by a forced rollover (12:03 into unit 3,1) were stored. So: samples older than the first unit opened since the restart are dropped silently. Loading older data would need `hisrecover` / `isfrename` / `ithrecover` (not practiced). Proposed close: documented in `load-history.md` and skill `history-management`. | `.claude/skills/system-management/tasks/load-history.md`; `examples/CI-Eng-Sample/README.md`; `knowledge/manuals/IM36K10J10-01EN.md` command-line tools |
 | ISS-007 | 2026-09-30 | INTEGRATION (monitoring) | `intdskmon` wrote 61.9 for a C: drive that is 61.9 % used / 38.1 % free, although the manual says it monitors the disk free space rate. `intspawn` did nothing when the command path was ~130 characters; a short path worked (limit unknown). | closed | Disk value: the test showed **used** % (61.9 on a 61.9 % used disk), and the task file says so; installed behaviour is the reference. `intspawn` path limit: not measured (needs admin edits of `tls\sup\<name>.sup` and restarts for each length); guidance kept: put the command in a `.cmd` with a short path (other CI Server tools cut paths at 79 characters, ISS-020). Closed 2026-10-01 (confirmed by user). | `.claude/skills/system-management/tasks/monitoring-processes.md`; `knowledge/manuals/IM36K10J10-01EN.md` §4.1.6; `examples/CI-Eng-Sample/monitoring/` |
-| ISS-008 | 2026-09-30 | ACCESS (ODBC server `odbsrv`) | `ci_start.log` on the test system shows `CppServerAPI::Run() failed: InitializeSslCtx(): SSL_CTX_use_certificate_chain_file() failed.` right after ACCESS Service starts. Which component and certificate is not known. | closed | Closed 2026-10-01 (confirmed by user): cause known, ODBC server left as is (not licensed/used on the test system). Identify in phase 7. 2026-10-01 (phase 7): cause found. The message comes from the ODBC server `odbsrv` (ACCESS Service, Simba): `odbsrv.sup` has `USESSL = YES` and `access_start.cmd` points it at `%TLS_ROOT_PATH%\tls\pki\odbsrv\SampleServerCertificate.pem` / `SampleServerKey.pem`, but that folder does not exist and no sample certificate is installed. `odbsrv` exits right after start (`DUR-W-REM_PROC, Process ODBSRV exited unexpectedly`), port 1583 does not listen. Fix (admin, only if ODBC is licensed and wanted): install a certificate + key there, or set `USESSL = NO`. Not applied. Close when the user confirms. | `.claude/skills/installation-security/tasks/setup-check.md`; `knowledge/manuals/IM36K10L45-01EN.md` §1 (done); `.claude/skills/data-access/tasks/access-checks.md` (done) |
+| ISS-008 | 2026-09-30 | ACCESS (ODBC server `odbsrv`) | `ci_start.log` on the test system shows `CppServerAPI::Run() failed: InitializeSslCtx(): SSL_CTX_use_certificate_chain_file() failed.` right after ACCESS Service starts. Which component and certificate is not known. | closed | R1.05 (2026-10-08): unchanged on the R1.05 test server: same `ci_start.log` message, `tls\pki\odbsrv` missing, port 1583 not listening, `odbsrv.sup` identical. Closed 2026-10-01 (confirmed by user): cause known, ODBC server left as is (not licensed/used on the test system). Identify in phase 7. 2026-10-01 (phase 7): cause found. The message comes from the ODBC server `odbsrv` (ACCESS Service, Simba): `odbsrv.sup` has `USESSL = YES` and `access_start.cmd` points it at `%TLS_ROOT_PATH%\tls\pki\odbsrv\SampleServerCertificate.pem` / `SampleServerKey.pem`, but that folder does not exist and no sample certificate is installed. `odbsrv` exits right after start (`DUR-W-REM_PROC, Process ODBSRV exited unexpectedly`), port 1583 does not listen. Fix (admin, only if ODBC is licensed and wanted): install a certificate + key there, or set `USESSL = NO`. Not applied. Close when the user confirms. | `.claude/skills/installation-security/tasks/setup-check.md`; `knowledge/manuals/IM36K10L45-01EN.md` §1 (done); `.claude/skills/data-access/tasks/access-checks.md` (done) |
 | ISS-009 | 2026-09-30 | Security Guide | DCOM port range printed as 20500–20550 in the firewall table but "2500–20550" in the OPC configuration table. Taken as a typo for 20500–20550. | closed | Confirm on a system with IT security applied. Closed 2026-10-01 (confirmed by user). | `knowledge/manuals/IM36K01C30-01EN.md` §4 |
 
 | ISS-010 | 2026-09-30 | ITEM (sub-items) | The Integrator sub-item adds value × seconds; setting `TIME_UNIT` = Hour made no difference (1 per second while the main item was 1). The Tutorial lists a time unit only for Rate-of-Change. | closed | 2026-09-30 (phase 5): IM 36K10C10 §3.2 and `itm.sup` answer it: the integral is divided by the **integration granule** `itm_int_secs` (label "Integration granule, sec.") in `itm.sup` — **system-wide**, installed value 1 (seconds); 60 = minutes, 3600 = hours. `TIME_UNIT` only applies to Rate-of-Change. Practiced 2026-09-30: set to 60 and restarted → `CI-Eng-Sample.PUMP1.RUNNING.RUN_SECONDS` rose exactly 1.0 in 60 s; restored to 1 (file identical to backup) → 8 in 8 s. Existing integrator values are not converted when the granule changes. Closed 2026-09-30 (confirmed by user). | `examples/CI-Eng-Sample/02b_sub_item_df.qli`; `knowledge/manuals/IM36K10G10-01EN.md` |
@@ -51,9 +51,9 @@ development system (see "Test system" in `progress.md`); they do not exist on ot
 | ISS-029 | 2026-09-30 | PROCESS (Java) | IM 36K10P11 §10.4 says a new Java class must be reset before objects are added, otherwise the code does not take effect. A Java class inserted with `COMPILE` 1 by `dssqld` ran its first object correctly without any reset (twice, including a full sample reload). | open | Installed behaviour is the reference; keep "reset after changing a class that has objects". Check whether the Engineering Module path (compile without quick load) behaves differently. | `knowledge/manuals/IM36K10P11-01EN.md` §7; `.claude/skills/class-object-engineering/tasks/java-class.md` |
 | ISS-030 | 2026-10-01 | BUS (UMH tools) | `umhman` (hex code → text) crashes with redirected input (bash: segmentation fault 139 with CRLF input; PowerShell `Start-Process -RedirectStandardInput`: 0xC0000005); with an argument it only prompts. `umhtestprog` prints `UMH TEST UTILITY` and crashes (segmentation fault). `umhmsg 8010008` stops with `umh_panic: …umhmsg.exe, license expired` although other tools (`dssqld`, `itmval`) still worked at that time. | closed | Retested 2026-10-01 right after a CI Server restart: all three work — `umhman` with piped input (bash, LF or CRLF; via `cmd <` too), `umhmsg 083A001B text "…"` writes the message to `umhlog.log` (process `UMHMSG_<pid>`, prints nothing), `umhtestprog` runs its self-test. The earlier failures came late in an unlicensed session (licence nearly expired). `itmval -f` (ISS-022) still crashes on a fresh start, so it is a separate fault. Closed 2026-10-01 (confirmed by user). | `.claude/skills/system-management/tasks/bus-utilities.md`; `knowledge/manuals/IM36K10L30-01EN.md` §3 |
 | ISS-031 | 2026-10-01 | LICENCE (unlicensed node) | The unlicensed test node counts down about 1 hour of run time per CI Server start (`License time left` in `smd_<node>_LOW_smdsnp_general.log`, 3600 s → `*** license problem : 3 ***`); then `dssqld`/`itmval` stop with `license expired` and `ISF-F-LIC_PROB, DATABASE Service is not licensed`. A PC sleep pauses the count (start 17:25, ran out 09:52 next day). Restart of the CI Service resets it (verified 2026-10-01, back after ~45 s). | closed | Closed 2026-10-01 (confirmed by user): known limitation of the unlicensed test system, documented in system-check. Known limitation of the test system, documented in `system-check`. Plan tests in ≤ 1 h blocks. Close when the user confirms. | `.claude/skills/system-check/SKILL.md` §3 (done) |
-| ISS-032 | 2026-10-01 | ACCESS (OPC UA server node IDs) | IM 36K10L45 §10.3 shows CI Server node IDs (`{"nsid":"32"}`, `{"0":"Value","itnm":"ITEM1"}`) and the CI Server namespace `http://www.yokogawa.com/CI_Server/` (ns 3) but not which namespace the **entities** use. With that URI (or `urn:<host>:Yokogawa:CI_SERVER_OPC_UA_SERVER`) the client point was silently not monitored. Browsing (`OPCUAC_TAG_DF`) shows sections/items in **`urn:Yokogawa:CI_SERVER_OPC_UA_SERVER`**; with it `{"0":"Value","itnm":"<item>"}` and `{"0":"Value","nsid":"<n>"}` both work. IM 36K10E20 §2.2.6 also asks to enable `OPXUAS_USE_NAME_NODEIDS` and restart for CI client ↔ CI server; not needed on the test system. | closed | Closed 2026-10-01 (user decision: installed software is the reference). Installed software is the reference (standing user decision). Close when the user confirms. | `knowledge/manuals/IM36K10L45-01EN.md` §7 (done); `knowledge/manuals/IM36K10E20-01EN.md` §3 (done); `.claude/skills/data-access/tasks/opcua-client.md` (done) |
+| ISS-032 | 2026-10-01 | ACCESS (OPC UA server node IDs) | IM 36K10L45 §10.3 shows CI Server node IDs (`{"nsid":"32"}`, `{"0":"Value","itnm":"ITEM1"}`) and the CI Server namespace `http://www.yokogawa.com/CI_Server/` (ns 3) but not which namespace the **entities** use. With that URI (or `urn:<host>:Yokogawa:CI_SERVER_OPC_UA_SERVER`) the client point was silently not monitored. Browsing (`OPCUAC_TAG_DF`) shows sections/items in **`urn:Yokogawa:CI_SERVER_OPC_UA_SERVER`**; with it `{"0":"Value","itnm":"<item>"}` and `{"0":"Value","nsid":"<n>"}` both work. IM 36K10E20 §2.2.6 also asks to enable `OPXUAS_USE_NAME_NODEIDS` and restart for CI client ↔ CI server; not needed on the test system. | closed | R1.05 (2026-10-08): sections are now IM 36K10L45 5th ed. §11.3 and IM 36K10E20 4th ed. §2.3; `OPXUAS_USE_NAME_NODEIDS` is still NO by default. Closed 2026-10-01 (user decision: installed software is the reference). Installed software is the reference (standing user decision). Close when the user confirms. | `knowledge/manuals/IM36K10L45-01EN.md` §7 (done); `knowledge/manuals/IM36K10E20-01EN.md` §3 (done); `.claude/skills/data-access/tasks/opcua-client.md` (done) |
 | ISS-033 | 2026-10-01 | ACCESS (Engineering Module OPC UA point) | Tested by the user: the point form's *Browse path* stops at the item (`Objects/CI-Eng-Sample/TANK1/INFLOW`) and stores the item **object** `{"nsid":"548"}`; the point is not monitored (revised sampling interval 0, connected item status 13, *Last value*/*Data type* empty). Typing `{"0":"Value","itnm":"CI-Eng-Sample.TANK1.INFLOW"}` in *Node Id* fixed it (values followed at once). Browsing into an item that is OPC visible but not *Read* fails (`UncertainNotAllNodesAvailable`, `OPXC-E-BRW_NODE`). | closed | Answered 2026-10-01 by the user: the browse dialog can expand the item; picking `…/LEVEL/Value` stored `{"0":"Value","nsid":"713"}` with *Last value* 85, *Data type* Double. So: pick the `Value` node, not the item. The `itnm` form stays the choice for quick load (`nsid` changes on reload). Closed 2026-10-01 (confirmed by user). | `knowledge/manuals/IM36K10E20-01EN.md` §2 (done); `.claude/skills/data-access/tasks/opcua-client.md` §3 (done) |
-| ISS-034 | 2026-10-01 | ACCESS (OPC UA server setup) | Installed vs IM 36K10L45 §10.5–10.6: `ServerConfig.xml` enables certificate user tokens (`EnableCertificate true`, manual false) and offers no `None` endpoint (only Basic256Sha256 / Aes128_Sha256_RsaOaep / Aes256_Sha256_RsaPss with Sign or SignAndEncrypt); the `rejected` folder is created only at the first rejection; `opxuas.sup` uses `OPXUAS_DYNAMIC_SCANRATE` (manual `OPXUAS_USE_DYNAMIC_SCANRATE`) and has `OPXUAS_SET_HIGH_PRIO_15` (not described); `opxsys.sup` has `OPXDAS_SET_LOG_LEVEL` (not described). Also `dur.sup` adaptive queue entry `OPCEXE` while the installed executors are `OPCEXE1`–`4`. | closed | Closed 2026-10-01 (user decision: installed software is the reference). Installed software is the reference (standing user decision). Close when the user confirms. | `knowledge/manuals/IM36K10L45-01EN.md` §4, §7 (done); `knowledge/manuals/IM36K10L30-01EN.md` §8 (done) |
+| ISS-034 | 2026-10-01 | ACCESS (OPC UA server setup) | Installed vs IM 36K10L45 §10.5–10.6: `ServerConfig.xml` enables certificate user tokens (`EnableCertificate true`, manual false) and offers no `None` endpoint (only Basic256Sha256 / Aes128_Sha256_RsaOaep / Aes256_Sha256_RsaPss with Sign or SignAndEncrypt); the `rejected` folder is created only at the first rejection; `opxuas.sup` uses `OPXUAS_DYNAMIC_SCANRATE` (manual `OPXUAS_USE_DYNAMIC_SCANRATE`) and has `OPXUAS_SET_HIGH_PRIO_15` (not described); `opxsys.sup` has `OPXDAS_SET_LOG_LEVEL` (not described). Also `dur.sup` adaptive queue entry `OPCEXE` while the installed executors are `OPCEXE1`–`4`. | closed | R1.05 (2026-10-08): all points still hold on the R1.05 test server; manual sections are now IM 36K10L45 5th ed. §11.6–11.7. Closed 2026-10-01 (user decision: installed software is the reference). Installed software is the reference (standing user decision). Close when the user confirms. | `knowledge/manuals/IM36K10L45-01EN.md` §4, §7 (done); `knowledge/manuals/IM36K10L30-01EN.md` §8 (done) |
 | ISS-035 | 2026-10-01 | ALARM (`ALDPRT`) | `ALDPRT` is running and connected (`almdbg` 1 shows `Events-send-to` rising with each alarm), `aldprt.sup` sets no log destination (so per IM 36K10L15 §4.3 it should log via UMH) and `EVENTS` includes `alarm`/`ackn`, but no alarm line appears in `tls\log\umhlog.log` for the CI-Eng-Sample HIGH / HIGH HIGH / acknowledge events. No other log file changed. Cause unknown (UMH filtering? output only with `LOGUMH` set explicitly?). | open | Rechecked 2026-10-01 after a restart: `aldprt.exe` runs; `umhlog.log` still has no alarm lines for the new `TANK1.LEVEL` HIGH alarm (only `ALD-I-ALDPRT_EXIT` at each licence shutdown). `fmfprt.sup` assigns printer function `ALARMS` to `ALDPRT`; destination `ALARMS` (policy *Automatic*) has **no device**, and `PRINTER_JOB_OVV` has no `ALDPRT` jobs. The `aldprt.sup` help says UMH is used only when no destination is enabled — the printer function may count as one. Next: test `LOGUMH` in `aldprt.sup` (admin, restart). Low priority: history and overviews are not affected. | `.claude/skills/alarm-management/tasks/item-alarming.md` (last line); `knowledge/manuals/IM36K10L15-01EN.md` §8 |
 | ISS-036 | 2026-10-01 | ALARM (setup) | Installed vs manuals: `alh.sup` has `DB-JRNL = WAL` and `DB-SYNC = OFF`, not described in IM 36K10L15 §3.4; storage group `ALH` has lifetime **52 weeks** while IM 36K10C20 §A7 says the default is 2 days (may have been changed on this system earlier — unknown); `aldprt.sup` uses `TIMEFMT` where the manual text also writes `TIMFMT`. | closed | Installed software is the reference (standing user decision). Close when the user confirms. Closed 2026-10-01 (confirmed by user). | `knowledge/manuals/IM36K10L15-01EN.md` §7, §8; `knowledge/manuals/IM36K10C20-01EN.md` §A7 |
 | ISS-037 | 2026-10-01 | ALARM (history fields) | `ALARM_CHRONO` records contain leftover or unreadable text: INFO events generated with `almdbg` 16 carry `INSTALL`/`UNIT`/`TAG`/`SUB` values from earlier events and non-ASCII bytes in `SOURCE`, `CATEGORY`, `CONDITION`; item events of `CI-Eng-Sample.TANK1.LEVEL` show `SUB` = `RoC` although the item has only the sub-item `MAX`. | closed | Rechecked 2026-10-01 after a restart: a new HIGH alarm on `CI-Eng-Sample.TANK1.LEVEL` (raised with `itmval -p`) gave a clean `ALARM_CHRONO` record (`INSTALL`/`UNIT`/`TAG` correct, `SUB` empty, `SOURCE`/`CATEGORY`/`CONDITION` empty), and the user's Current Alarm Overview showed correct columns. The leftover/garbled values are limited to the older records (INFO events made with the `almdbg` 16 test function and events from that session). Documented: treat `SUB`/`SOURCE`/`CATEGORY`/`CONDITION` as reliable only for normal item and OPC events. Closed 2026-10-01 (confirmed by user). | `.claude/skills/alarm-management/tasks/alarm-checks.md` §4 |
@@ -80,7 +80,7 @@ development system (see "Test system" in `progress.md`); they do not exist on ot
 | ISS-058 | 2026-10-02 | DATA EXPOSURE (ITEM_HISTORY, manual vs installed) | IM 36K10G10 ch. 10 lists `ITEM_HISTORY` as an exposure source (filter required). The installed `dbc.sup` (R1.03 and R1.05, identical) has the change-log line `PCL Aug-19 e12150 Refactor to support MS-SQL/ODBC, remove ITM history support`. An `ITEM_HISTORY` record (all fields, quoted filter, ISS-057) on the user's R1.05 system never created its table; it was disabled and then deleted, so whether ITEM_HISTORY works with a correct filter is **not tested**. | open | Treat ITEM_HISTORY exposure as unsupported and use `ITEM_VALUES` with `AGG_INTERVAL`. To close: on an R1.05 system, create an `ITEM_HISTORY` record with an unquoted filter and check whether `DBCSND` stays up and the table is created. | `.claude/skills/data-access/tasks/rdbms-exposure.md`; `knowledge/manuals/IM36K10G10-01EN.md`; `knowledge/manuals/IM36K10L45-01EN.md` §8 |
 | ISS-059 | 2026-10-02 | DATA EXPOSURE (authentication) | IM 36K10G10 §10.2 says to add the `CIX_PROCESS` account to SQL Server as a Windows user (db_owner) in a domain. The CI Service runs as the **local** `.\CIX_PROCESS` (also on the user's domain-joined R1.05 CI Server), which a SQL Server on another host cannot authenticate. | closed | Closed 2026-10-02 (confirmed by user): use a SQL login with db_owner on the target database; SQL Server set to mixed mode (needs a SQL Server restart). Windows authentication only if the SQL host knows the account (not tested). Tested in R1.05 only. | `.claude/skills/data-access/tasks/rdbms-exposure.md` (done); `knowledge/manuals/IM36K10G10-01EN.md` (done) |
 | ISS-060 | 2026-10-02 | DATA EXPOSURE (rows of steady items) | IM 36K10G10 ch. 10 says `ITEM_VALUES` is exposed once per interval, with the aggregation time as timestamp when the item did not change. In one snapshot on R1.05 (1-minute interval), changing items had rows at 02:13:23 while steady items (`VALUE_COUNT` 1) were still at 02:12:24. Whether steady items get a row every interval (maybe written later) or only after an update is not known. | open | Count rows per item over one hour (`SELECT NAME, COUNT(*) … WHERE [TIMESTAMP] > … GROUP BY NAME`) and compare steady with changing items. Until then the task says: take a steady item's last row at or before T. | `.claude/skills/data-access/tasks/rdbms-exposure.md` |
-| ISS-061 | 2026-10-02 | INSTALLATION (folder permissions) | On the user's R1.05 system installed in `C:\Yokogawa\CIServer` (outside Program Files) `tls\sup` and `dbc.sup` inherit **Authenticated Users: Modify** (plus Users: Read): any signed-in user can read the SQL password in `dbc.sup` and change setup files. On the R1.03 development machine (Program Files) `tls\sup` gives Users: ReadAndExecute (read still possible, no write). | closed | Closed 2026-10-02 (user decision: shared internal dev/demo server, left as is). Option if needed, not applied or tested: `icacls <dbc.sup> /inheritance:r /grant:r "SYSTEM:(F)" "Administrators:(F)" "CIX_PROCESS:(R)"`; folder rights in general are set by the IT Security Tool. | `.claude/skills/installation-security/tasks/setup-check.md` (done); `.claude/skills/data-access/tasks/rdbms-exposure.md` (done) |
+| ISS-061 | 2026-10-02 | INSTALLATION (folder permissions) | On the user's R1.05 system installed in `C:\Yokogawa\CIServer` (outside Program Files) `tls\sup` and `dbc.sup` inherit **Authenticated Users: Modify** (plus Users: Read): any signed-in user can read the SQL password in `dbc.sup` and change setup files. On the R1.03 development machine (Program Files) `tls\sup` gives Users: ReadAndExecute (read still possible, no write). | closed | R1.05 (2026-10-08): confirmed again on the R1.05 test server (`icacls`: Authenticated Users:(M) inherited on the install folder and `tls\sup`). Closed 2026-10-02 (user decision: shared internal dev/demo server, left as is). Option if needed, not applied or tested: `icacls <dbc.sup> /inheritance:r /grant:r "SYSTEM:(F)" "Administrators:(F)" "CIX_PROCESS:(R)"`; folder rights in general are set by the IT Security Tool. | `.claude/skills/installation-security/tasks/setup-check.md` (done); `.claude/skills/data-access/tasks/rdbms-exposure.md` (done) |
 | ISS-062 | 2026-10-02 | GRAPHICS (layouts) | `Layouts.readme` lists the menu/toolbar command `help`, but in R1.03 the Operator Interface fails with *Failed to execute menu command 'help'*, *Unrecognized keyword* (`MNUCMD`, `IllegalArgumentException`). The factory layouts do not use it. | open | Software is the reference: documented as not supported. Close when the user confirms. | `.claude/skills/graphics/tasks/layouts.md` §6 (done) |
 | ISS-063 | 2026-10-02 | GRAPHICS (layouts) | The readme does not say that menu items with the commands `toolbar`, `statusline` and `playback record` must be `type="check"`. With a normal item the Operator Interface does not start (*INITFAILED*, `JMenuItem cannot be cast to JCheckBoxMenuItem` in `MenuToolbarOption.checkState`); the web client just drops check items. | open | Rule added to the task. Close when the user confirms. | `.claude/skills/graphics/tasks/layouts.md` §6 (done) |
 | ISS-064 | 2026-10-02 | GRAPHICS (layouts) | Readme: `rows`/`cols` `n*` values share the remaining space by fraction (as HTML frames). Observed: the desktop ignores the fractions (`2*,1*` gave 800:88 px, sizes follow the displays); the web client turns every `n*` into its single *main* panel, so two `n*` overwrite each other. | open | Use one `n*` per frame set, all other divisions in pixels or `fitDisplay`. Close when the user confirms. | `.claude/skills/graphics/tasks/layouts.md` §6 (done) |
@@ -95,3 +95,19 @@ development system (see "Test system" in `progress.md`); they do not exist on ot
 | ISS-073 | 2026-10-06 | DSS (remove group / DSSSDA) | Removing an authorization group while a session of one of its users is open fails with *DSSP-E-NODEL … in dataset USER_VAL*; after logging out the session was still referenced, and a retry stopped the process `DSSSDA03` (*DUR-F-BAD_SIZE, Negative size not allowed*; `DUR-W-REM_PROC … exited unexpectedly`); following DSS requests failed with *DUR-F-UNKNOWN_ATT … DSSSDA03* until CI Server was restarted (2026-10-06). After the restart the group was removed without error. `USER_VAL` exports only its header, so open sessions cannot be listed. | open | Workaround: log out the user's sessions and restart CI Server before removing the group; noted in the sample `remove.cmd` / README and `users-groups.md`. Not repeated on purpose (it stops a CI Server process). Report to Yokogawa. | `.claude/skills/authorization/tasks/users-groups.md` (done); `examples/CI-Eng-Sample/remove.cmd`, `README.md` (done) |
 | ISS-074 | 2026-10-06 | GRAPHICS (HTML display login) | IM 36K10R30 §4 lists the user profile fields used by the HTML display login as "… initial display, locale (layout not)". On R1.03.00 the profile's *Layout* is used too: a logon as `CIENG` (layout `CIENG_Operator`) at `/mobileoperator/` without `?l=` opened `CIENG_Operator` (2026-10-02 with ADMIN, 2026-10-06 with `CIENG`). | open | Installed software is the reference; R30 summary and `layouts.md` §3 updated. Close when the user confirms. | `knowledge/manuals/IM36K10R30-01EN.md` (done); `.claude/skills/graphics/tasks/layouts.md` §3, §5 (done) |
 | ISS-075 | 2026-10-06 | GRAPHICS (`jwuiutl -v`) | `deploy-displays.md` called `jwuiutl -v` "report only", but `jwuiutl -d -v -i -l <log> <display>` re-saves the validated display (normalised XML: defaults dropped, positions as attributes; 9 618 → 11 191 bytes for `CIENG_Test`, 2026-10-06). On 2026-10-02 a validation of eight displays hung on one and left `<name>.lck` and `<name>.xml.tmp`; not reproduced on 2026-10-06. | open | Documented in `deploy-displays.md` §2 and the C50 summary. Close when the user confirms. | `.claude/skills/graphics/tasks/deploy-displays.md` §2 (done); `knowledge/manuals/IM36K10C50-01EN.md` (done) |
+| ISS-076 | 2026-10-08 | EQUIPMENT (IEC 104 naming, R1.05) | IM 36K10L41 5th ed. §3.31.1–3.31.2 still calls the IEC 104 manager `eqp104` / `eqp104.sup` and says its name starts with "eqp". R1.05 installs `eqt104.exe` (no `eqp104.exe`), template `eta104_eqt.sup`, and `IEC104_LINE_DF.EQUIPMENT_MAN` defaults to `EQT104` (R1.05 test server, read-only). App. 1.3 gives upgrade steps for IEC 61850 only. Unknown whether an R1.03 IEC 104 line needs the same renaming after an upgrade. | open | Installed software is the reference; summaries use `EQT104`. Needs an upgrade test or a Yokogawa answer. | `knowledge/manuals/IM36K10L41-01EN.md` §1–2, §3.28–3.31 row (done); `.claude/skills/equipment/SKILL.md` (done) |
+| ISS-077 | 2026-10-08 | EQUIPMENT (IEC 104 setup file, R1.05) | The installed template `eta104_eqt.sup` has a keyword `quality_code_parsing = Y\|N` (default N) that moves IEC 104 cause of transmission and quality flags into the item quality field instead of the item status. The 5th ed. manual does not describe it. | open | Behaviour not tested (no IEC 104 device). | `knowledge/manuals/IM36K10L41-01EN.md` §3.28–3.31 row (done) |
+| ISS-078 | 2026-10-08 | EQUIPMENT (EQT utilities, R1.05) | IM 36K10L40 4th ed. describes only `eqpfrcscn`, `eqpiostat` and `eqpdbg` (and still lists IEC 61850, I/O type 1636, under `eqpfrcscn`). R1.05 installs `eqtdbg` (same menu, default process `EQT`), `eqtfrcscn` (template `eqtfrcscn.tpl`) and `eqtiostat` (start line commented out in `equipment_start.cmd`). None is in the manual. | open | Documented from installed files only; `eqtdbg`/`eqtfrcscn` not run (shared server, no EQT line). | `knowledge/manuals/IM36K10L40-01EN.md` §1–3, installed section (done); `.claude/skills/equipment/SKILL.md` (done) |
+| ISS-079 | 2026-10-08 | EQUIPMENT (IEC 61850 client name) | IM 36K10L41 5th ed. §3.32 tells the user to give the IED engineer the client name "EQP850", while §3.32.1 and App. 1.3 use `EQT850`, the process name R1.05 actually uses. | open | Presumably `EQT850`; low priority. | `knowledge/manuals/IM36K10L41-01EN.md` §3.32 (done) |
+| ISS-080 | 2026-10-08 | ACCESS (OPC UA client status item, R1.05) | IM 36K10E20 4th ed. §2.1.2 lists integer states 0–5 for the station `STATUS_ITEM` (0 preparing, 1 connected, 2 communication error and reconnecting, 3 connect attempt failed, 4 server shutdown received, 5 connection recreated); IM 36K10L45 5th ed. §10.9.2 still calls it a Boolean. On R1.03 a Boolean item with 1 = connected was verified. | open | R1.05 (2026-10-08): with the sample's Boolean status item the station showed 0 / status 4 while the server rejected the client and 1 / status 5 when connected; integer states 2–5 still not observed. Re-test on an R1.05 system with an Integer status item (not on the shared R1.05 test server without approval). | `.claude/skills/data-access/tasks/opcua-client.md` §2; `knowledge/manuals/IM36K10E20-01EN.md` |
+| ISS-081 | 2026-10-08 | ACCESS (OPC UA server `ServerConfig.xml`, R1.05) | IM 36K10L45 5th ed. §11.7 places `ServerConfig.xml` in `%TLS_ROOT_PATH%\tls\exe`; on the R1.05 test server it exists only in `%TLS_SAV_PATH%` (IM 36K10E20 4th ed. §3.4 agrees). On R1.03 it was in `tls\exe`. The R1.05 file only adds SDK blocks (roles, user password management, PubSub settings, thread pools). | closed | Installed software is the reference (standing user decision). Close when the user confirms. | `.claude/skills/data-access/tasks/access-checks.md`; `knowledge/manuals/IM36K10L45-01EN.md`; `knowledge/manuals/IM36K10E20-01EN.md` |
+| ISS-082 | 2026-10-08 | ACCESS (OPC UA server keywords, R1.05) | The manual names the switch that keeps the native model visible next to an imported information model `OPXUAS_ENABLE_NATIVE_MODEL_TREE`; the installed `opxuas.sup` has `OPXUAS_ENABLE_OWN_MODEL_TREE`. The installed file also has a hidden `OPXUAS_METHOD_TIMEOUT_MARGIN` (10000 ms) that the manual does not describe. | closed | Installed software is the reference (standing user decision). Close when the user confirms. | `knowledge/manuals/IM36K10L45-01EN.md` |
+| ISS-083 | 2026-10-08 | ACCESS (OPC UA client setup defaults, R1.05) | IM 36K10L45 5th ed. §10.11 gives `OPXC_SERVICE_CALL_TIME_OUT` default 10 s; the installed template `epauac_eqp.sup` has 60 s. The template also has `OPXC_DISABLE_SAV_FILE`, `OPXC_ALARM_TIME_ATTRIBUTE` and a hidden `OPXC_CERT_EXP_PERIOD_WARN` (2 months) that the manual does not describe. The installed `opxuac_mon.sup` was not updated (still 10 s, none of the new keywords). | open | Installed software is the reference. Open question: whether per-process files created on R1.03 should get the new keywords after an upgrade. | `knowledge/manuals/IM36K10L45-01EN.md`; `.claude/skills/data-access/tasks/access-checks.md` |
+| ISS-084 | 2026-10-08 | ACCESS (OPC UA client fallback setup file) | The R1.03 manual (and the R1.03 summary) named the fallback client setup file `opxuac.sup`, which exists on neither version. The R1.05 manual (IM 36K10L45 5th ed. §10.11) names `epauac_eqp.sup`, which matches both installations. | closed | Answered by the R1.05 manual and the installed files. Close when the user confirms. | `knowledge/manuals/IM36K10L45-01EN.md` |
+| ISS-085 | 2026-10-08 | ACCESS (OPC A&E server, R1.05) | The installed `opxsys.sup` has a new keyword `OPXAES_DIR_ALM = YES` (A&E server "direct" alarm events) that IM 36K10L45 5th ed. does not describe. | open | Behaviour not tested (OPC A&E loopback is not allowed). | `knowledge/manuals/IM36K10L45-01EN.md`; `.claude/skills/data-access/tasks/access-checks.md` |
+| ISS-086 | 2026-10-08 | INSTALLATION (upgrade merge, R1.05) | IM 36K01C10 5th ed. §2.1.5, §3.3.8, §3.3.15 write the upgrade backup, `jupgutl`, `jmrgconfig.properties` and log paths as `C:\Program Files (x86)\…` and `C:\Users\Public\…`. On the R1.05 test server (installed in `C:\Yokogawa\CIServer`) they are `%TLS_ROOT_PATH%\tls\upg`, `%TLS_ROOT_PATH%\tls\com\jupgutl.cmd`, `%TLS_WAP_PATH%\cfg\properties\jmrgconfig.properties` and `%TLS_SAV_PATH%\jmrg\ref-data`. The text says `-c` takes the properties file, but the examples pass the `properties` folder. | open | Paths written with `%TLS_*%`. The `-c` argument needs a test on a non-shared machine (no upgrade was done on the R1.05 test server). | `knowledge/manuals/IM36K01C10-01EN.md`; `.claude/skills/installation-security/SKILL.md` |
+| ISS-087 | 2026-10-08 | SECURITY (RESTful API ports, R1.05) | The RESTful API server `jrstsrv` listens on TCP 34597 (documented, `JRST_NETWORK_PORT`) and also on TCP 7073 on all addresses. 7073 is not in the Security Guide port table (IM 36K01C30 5th ed. §3.2) or in `jrstsrv.sup`. | open | Do not open 7073 in the firewall unless a need is found. Find out what it is (Yokogawa question). | `knowledge/manuals/IM36K01C30-01EN.md`; `.claude/skills/installation-security/tasks/setup-check.md` |
+| ISS-088 | 2026-10-08 | WINDOWS (WMIC) | IM 36K01C10 5th ed. App. 1.3 still uses `wmic qfe list full`, but WMIC is not installed on Windows Server 2025 / 24H2 (missing on the R1.05 test server). `Get-HotFix` works there. | closed | Use `Get-HotFix`. Close when the user confirms. | `knowledge/manuals/IM36K01C10-01EN.md`; `tools/setup_check.ps1` |
+| ISS-089 | 2026-10-08 | INSTALLATION (local groups, R1.05) | On the R1.05 test server (no dual-redundant platform, no IT Security Tool) the local group `RDC_GA_CLIENT` exists with member `CIX_PROCESS`. The Security Guide mentions this group only for the dual-redundant platform (IM 36K01C30 5th ed. §4.9). | closed | Information only: apparently created by the installer; no action. Close when the user confirms. | `knowledge/manuals/IM36K01C30-01EN.md` |
+| ISS-090 | 2026-10-08 | DOCS (CI Server + PRM) | IM 36K01C10 5th ed. §4.1.1 requires PRM R4.06 or later in a note but R4.08 or later in Table 4.1.1-1 (integration code 1901-0302-03-01). | open | Use R4.08 until clarified (from docs; no PRM available). | `knowledge/manuals/IM36K01C10-01EN.md` |
+| ISS-091 | 2026-10-08 | DSS (temporary files) | Each `dssqld` run (exports and quick loads) left a 0-byte `dss_<n>_<id>.tmp` in `%TLS_LST_PATH%`, and loading a class left a `dss_*.tmp` holding the class source (R1.05 test server: 34 files after one session of checks and a sample load/remove). They are not removed by CI Server. | closed | Test cleanup deletes them: `examples/CI-Eng-Sample/shared/clean_dss_tmp.ps1 -Since <test start>` (0-byte files and files with sample text only). Not checked on R1.03. Close when the user confirms. | `examples/CI-Eng-Sample/README.md` (done); `knowledge/r105-verification.md` (done) |
diff --git a/knowledge/manuals/IM36K01A50-01EN.md b/knowledge/manuals/IM36K01A50-01EN.md
index ce18d65..3fcf71b 100644
--- a/knowledge/manuals/IM36K01A50-01EN.md
+++ b/knowledge/manuals/IM36K01A50-01EN.md
@@ -1,15 +1,17 @@
 ---
 manual: IM 36K01A50-01EN
 title: CI Server Release Information
-edition: 3rd Edition, Sep. 2023
-version: R1.03
-status: from docs
+edition: 5th Edition, Feb. 2026 (section "Platform and installation"); other sections still from the 3rd Edition, Sep. 2023
+version: R1.05 (first written for R1.03); only "Platform and installation" re-checked so far
+status: from docs ("Platform and installation" compared with the 5th edition on 2026-10-08; Start-menu folder checked on the R1.05 test server)
 ---
 
-# Release Information: known issues and cautions (R1.03)
+# Release Information: known issues and cautions (R1.05)
 
 Known limitations and workarounds that the other manuals do not cover. Check this list
-before recommending a workflow in any area. Section numbers refer to the manual.
+before recommending a workflow in any area. Section numbers refer to the manual. The
+"Platform and installation" table follows the 5th edition (R1.05); the other sections were
+written from the 3rd edition (R1.03) and are re-checked with their skills.
 
 ## Platform and installation
 
@@ -19,10 +21,12 @@ before recommending a workflow in any area. Section numbers refer to the manual.
 | Dual-redundant platform (1.1) | After both computers restart, the former standby may come up as *Guest OS (Isolated)*. | In the Redundancy Management Tool set Next Status to *Standby*, then restart that computer. |
 | IT Security tool (1.3) | Remote Desktop to the CI Server may fail after applying IT Security if OS patch levels differ. | Patch both the server and the RDP client to the latest level. |
 | IT Security tool (1.3) | Changing Windows region/language after applying IT Security causes problems. | Set region and language **before** applying IT Security; never change afterwards. |
-| Windows (1.4) | Windows Server 2016 start menu may not refresh after install. | Restart after installing CI Server. |
-| Windows (1.4) | CI Server started from the command line on Win10 / Server 2016 needs elevation. | Always use *Run as administrator*. |
+| IT Security tool (1.3, R1.04+) | Upgrading from R1.03 or earlier where the IT security defaults were changed: a dialog offers to reset the account lockout settings (threshold, counter reset, duration). | Answer Yes (No returns to the start of the IT security setup); afterwards set any custom lockout values again. |
+| Windows (1.4) | CI Server started from the command line on Win10 / Win11 needs elevation. (The R1.03 Server 2016 start-menu note is gone.) | Always use *Run as administrator*. |
 | Windows (1.4) | Custom fonts can cause visual glitches in the Engineering and Edit modules. | Avoid custom fonts. |
-| Install path (1.9) | The MELSEC EZSocket installer fails if CI Server is in a non-default path that contains spaces. | Non-default install paths must have no spaces. |
+| Windows (1.4, R1.04+) | After a user without rights to the CI Server programs opens the CI Server Start-menu folder, its icons stay blank for everyone. | In an elevated prompt, in `C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CI Server` (likewise *CI Server Remote Connect*, *YOKOGAWA Security*, *YOKOGAWA Redundancy*) run `COPY /B * +,,` to touch the shortcuts. The manual's path has typos; the folder name was checked on the R1.05 test server (2026-10-08). |
+| Install path (1.9) | The MELSEC EZSocket installer fails if CI Server is in a non-default path that contains spaces (still in the 5th edition). | Non-default install paths must have no spaces. |
+| MELSEC (1.9, R1.05) | iQ-R support now uses EZSocket 5.9, installed from `<ISO drive>\Windows\EZSocketPcRedistributableInstaller` (`RunInstaller` as administrator); Mitsubishi reports a vulnerability in it. | Uninstall older EZSocket first. Keep the EZSocket folder writable by Administrators only, run antivirus, keep the PC off untrusted networks (VPN/firewall for remote access), open no untrusted files or links. |
 | Virtual machines (1.19) | Live migration, failover and shared-storage path switching lose acquired data/alarms; failover during engineering can corrupt the engineering data. | Migrate only when no engineering is in progress; keep engineering backups. |
 | Virtual machines (1.19) | Serial-only drivers (Siemens 3964R, telemetry integration), Siemens SAPI-S7 and MELSEC are unavailable on VMs; many other drivers work over TCP/IP only. | Check driver support before choosing a VM. |
 | Virtual machines (1.19) | Do not use VM replication; do not mix physical and virtual machines in HAC; only thin clients may RDP into a virtual CI Server. | Design accordingly. |
@@ -31,7 +35,7 @@ before recommending a workflow in any area. Section numbers refer to the manual.
 ## Services
 
 **ACCESS (1.5)**
-- OPC classic on Win10 / Server 2016 / 2019 needs .NET 3.5. Install it from the Windows medium
+- OPC classic on Win10 / Win11 / Server 2019 / 2022 needs .NET 3.5 (5th edition; R1.03 listed Server 2016). Install it from the Windows medium
   (`DISM /Online /Enable-Feature /FeatureName:NetFx3 /All /LimitAccess /Source:<drive>:\sources\sxs`),
   then re-run the OPC Core Components Redistributable in `%TLS_EXE_PATH%`.
 - OPC AE: items in the tree root (no section) appear as `.NAME` and some clients can't use them
@@ -50,12 +54,14 @@ before recommending a workflow in any area. Section numbers refer to the manual.
   application appearing. Expected behavior.
 
 **EQUIPMENT (1.9)**
-- MELSEC iQ-R needs Mitsubishi EZSocket 4.4: uninstall older EZSocket first, then run
-  `RunInstaller` (as administrator) from `%TLS_ROOT_PATH%\tls\exe\EZSocketPcRedistributableInstaller`.
+- MELSEC iQ-R: R1.03 needed Mitsubishi EZSocket 4.4 from `%TLS_ROOT_PATH%\tls\exe\EZSocketPcRedistributableInstaller`;
+  R1.05 uses EZSocket 5.9 from the install media (see the MELSEC row in the table above).
+  Uninstall older EZSocket first and run `RunInstaller` as administrator.
 - IEC 61850: add the line, then the station (General tab: device IP; Options tab: domain prefix
   and report object), then points. The element address is `<domain prefix><rest>`; the point
   I/O address is only the part **after** the prefix (the prefix is added automatically).
-  Wrong delimiting means no reports/elements are created.
+  Wrong delimiting means no reports/elements are created. (R1.03 edition; this precaution was
+  removed in the 5th edition, see the L41 summary §3.32 for R1.05.)
 
 **PROCESS (1.10)**
 - Java classes that access datasets must get the DSS session with `getDssSession()` (never
diff --git a/knowledge/manuals/IM36K01C10-01EN.md b/knowledge/manuals/IM36K01C10-01EN.md
index d5e56f2..c6c3d23 100644
--- a/knowledge/manuals/IM36K01C10-01EN.md
+++ b/knowledge/manuals/IM36K01C10-01EN.md
@@ -1,27 +1,37 @@
 ---
 manual: IM 36K01C10-01EN
 title: CI Server Setup
-edition: 3rd Edition, Sep. 2023
-version: R1.03
-status: from docs (Windows settings checked read-only on the test system with tools/setup_check.ps1)
+edition: 5th Edition, Feb. 2026
+version: R1.05 (first written for R1.03, 3rd Edition, Sep. 2023)
+status: from docs (Windows settings, services, ports and upgrade-merge files checked read-only on the R1.03 test system and the R1.05 test server, 2026-10-08; not tested on the R1.05 test server: IT security, Vnet/IP, the upgrade merge itself and PRM, which are not available there)
 ---
 
-# CI Server Setup (R1.03)
+# CI Server Setup (R1.05)
 
-New installation, maintenance (start/stop, reinstall, upgrade, licence, uninstall) and network
-tools. Section numbers refer to the manual.
+New installation, maintenance (start/stop, reinstall, upgrade, licence, uninstall), network
+tools and, new in R1.05, connection to other Yokogawa products (PRM). Section numbers refer to
+the 5th edition. The manual prints the default paths (`C:\Program Files (x86)\Yokogawa\CIServer`,
+`C:\Users\Public\Yokogawa\tls`); on a machine installed elsewhere use the `TLS_*` variables
+(ISS-086).
 
 ## 1. Before you start
 
-- Needed: the CI Server software medium (or its ISO) and one **Activated License File per
-  server** (an upgrade needs one that includes the Upgrade License).
-- Supported OS for R1.03: Windows 10 Pro / Enterprise (64-bit), Windows 10 Enterprise and IoT
-  Enterprise 2016 LTSB and 2019 LTSC, Windows Server 2016, Windows Server 2019, Windows Server
-  IoT 2019. On **Windows 10 Pro/Enterprise (non-LTSB/LTSC) the Vnet/IP drivers and the IT
-  Security Tool are not supported**. VMs run Windows Server 2019.
-- Only listed software may coexist: Chrome / Firefox / Edge 112, Microsoft Office 2016/2019/365
-  (Excel Add-in), PI AF SDK 2.10.5 + .NET 4.6.2, Adobe Acrobat (Reader) DC, Yokogawa standard
-  antivirus, Standard Whitelisting Software for Endpoint Security. Anything else may disturb CI Server.
+- Needed: the CI Server ISO file and one **Activated License File per server** (an upgrade
+  needs one that includes the Upgrade License).
+- Supported OS for R1.05 (§1.3.2), all 64-bit: Windows 10 Enterprise / IoT Enterprise LTSC
+  2019 and 2021; Windows 11 Pro and Enterprise; Windows 11 Enterprise / IoT Enterprise LTSC
+  2024; Windows Server 2019 / IoT 2019, 2022 / IoT 2022 and 2025 / IoT 2025 (Standard).
+  - On **Windows 11 Pro/Enterprise and Server 2025 the Vnet/IP drivers and the IT Security
+    Tool are not supported**; the other OSs also allow CI Server and PRM on one computer.
+  - Gone since R1.03: Windows 10 Pro/Enterprise (non-LTSC), LTSB 2016, Server 2016. The R1.03
+    rule "VMs run Windows Server 2019" is no longer in the manual.
+  - Verified (R1.05 test server, 2026-10-08): CI Server R1.05 runs on Windows Server 2025
+    Datacenter, an edition the list does not name.
+- Only listed software may coexist (§1.3.3): Chrome 130, Firefox 131, Edge 130; Microsoft
+  Office 2024 / Microsoft 365 (Excel Add-in); PI AF SDK 2.10.5 + .NET 4.6.2; Python 3.12
+  (pyTOOLS); SimbaClient ODBC driver 10.2; Adobe Acrobat / Acrobat Reader DC; Yokogawa standard
+  antivirus; Standard Whitelisting Software for Endpoint Security (not on Windows 11 Pro or
+  Server 2025; ask Yokogawa before using it on VMs). Anything else may disturb CI Server.
 
 ## 2. New setup
 
@@ -33,13 +43,16 @@ tools. Section numbers refer to the manual.
    Windows network settings.
 4. Install CI Server (with or without the IT Security Tool).
 5. Apply IT security settings (IT Security Tool; Domain Link Management Tool for linked domain).
+   Use the same security model as the Yokogawa products it connects to or shares the PC with.
 6. Apply the CI Server licence.
 
 On a VM (§2.2): mount the ISO, Windows settings, (Vnet/IP) **Vnet/IP Interface Package**
 instead of drivers/card, VM network settings, install, IT security, licence, then VM
 settings (auto start/shutdown with host, allow RDP from thin clients, disable NetBIOS over
 TCP/IP, network metrics favouring the plant network). On VMs, adapters not used for Vnet/IP
-must not use 192.168.0.0/16. Dual-redundant platform: see §2.3 and IM 30A05C30.
+must not use 192.168.0.0/16. The Vnet/IP Interface Package works only with IT security
+applied. Mounting the ISO from Hyper-V Manager needs a Server 2019 or 2022 Datacenter host
+with the Hyper-V role (§2.2.1). Dual-redundant platform: see §2.3 and IM 30A05C30.
 
 ### Windows settings (§2.1.2)
 
@@ -49,23 +62,32 @@ must not use 192.168.0.0/16. Dual-redundant platform: see §2.3 and IM 30A05C30.
 | Visual effects | *Let Windows choose what's best* |
 | Processor scheduling | *Programs* |
 | Virtual memory | Custom size, initial = maximum = 1.5 × RAM (e.g. 6 GB RAM → 9216 MB); restart |
-| Power | *High performance*; disk, sleep, hibernate, display: never; hybrid sleep off; wake timers off; power button = shut down |
-| Fast startup | Off: run `<DVD>\Windows\Tool\HiberbootDisabled.bat` as administrator (`HiberbootEnabled` = 0); required before Vnet/IP drivers on Win10 |
-| Windows Defender | Turned off by group policy (Server 2016: *Turn off Windows Defender*; 2019: *Turn off Windows Defender Antivirus*) |
+| Power | *High performance*; disk, sleep, hibernate, display: never; hybrid sleep off; wake timers off; adaptive brightness off; power button = shut down |
+| Fast startup | Off: run `<ISO drive>\Windows\Tool\HiberbootDisabled.bat` as administrator (`HiberbootEnabled` = 0); required before Vnet/IP drivers on Win10 |
+| Microsoft Defender Antivirus | Turned off by group policy *Turn off Microsoft Defender Antivirus*. Exceptions: on Windows 11 Pro 24H2 keep it on; on Win10 LTSC 2021 and Win11 LTSC 2024 it cannot be turned off |
 | Automatic Windows updates | Disabled by group policy (*Configure Automatic Updates* = Disabled). With WSUS: install CI Server first, then disable from WSUS |
 | Drive optimization | Scheduled optimization off |
 | Automatic cleanup | Task Scheduler › Microsoft › Windows › Servicing › `StartComponentCleanup` disabled |
-| Windows updates | KB5023702 (2023-03) on Win10 2019 LTSC / Server 2019, or folder permissions may be wrong |
-| .NET Framework 3.5.1 | Installed (`dism /online /enable-feature /featurename:NetFX3 /all /Source:<DVD>:\sources\sxs /limitaccess`, or Server Manager feature) |
-| DCOM | Default Authentication Level = *Connect*; restart |
+| Windows updates | Apply the per-OS list of cumulative OS and .NET updates in §2.1.2 (state of Feb. 2026; Yokogawa's Endpoint Security Service has the current list), or some install-folder rights may be wrong. Replaces the single R1.03 update KB5023702 |
+| .NET Framework 3.5.1 | Installed on all listed OSs (`dism /online /enable-feature /featurename:NetFX3 /all /Source:<drive>:\sources\sxs /limitaccess` from the Windows medium, or the Server Manager feature) |
+| DCOM | Default Authentication Level = *Connect* (needed for OPC Classic on a CI Core); restart |
 | Display | Scale 100 % |
 | 8dot3 names | `fsutil behavior set disable8dot3 2`; restart |
+| Japanese keyboards (new) | On Win10 LTSC 2021 / Win11 LTSC 2024 switch to the previous Microsoft IME version |
+
+Verified (R1.05 test server, 2026-10-08): a server can run CI Server with several of these
+not applied (Defender on, updates and cleanup not disabled, no .NET 3.5); the manual still
+requires them for operation.
 
 ### Vnet/IP (§2.1.1, §2.1.3, §2.1.4)
 
 - Card DIP switches: domain 1–16, station 1–64 (start from 64 downwards), each with odd
   parity; action-mode switch all OFF. One card per computer; card before drivers.
-- Drivers from `<DVD>\Windows\VnetVirtualProduct\VirtualProduct_CIServer_package*.zip` →
+- Which drivers: Vnet/IP and Ethernet on the same computer → control bus driver only (no open
+  communication driver); Vnet/IP only → both; no Vnet/IP → neither.
+- Before the open communication driver on Win10 LTSC 2019, Server 2019 or Server 2022, check
+  in `msinfo32` that **Kernel DMA Protection** is Off (switch it off in the BIOS if needed).
+- Drivers from `<ISO drive>\Windows\VnetVirtualProduct\VirtualProduct_CIServer_package*.zip` →
   `installVirtProd.cmd` (VM: `installVirtProdVPF.cmd`), as administrator, antivirus off.
 - Rename connections: *Ethernet*, *Vnet*, *VnetIPOpen* (VM: *VnetIPBUS1*, *VnetIPBUS2*,
   *RemoteUINetwork*). Disable IPv6; Vnet uses only *Yokogawa Vnet Protocol* + IPv4.
@@ -73,7 +95,7 @@ must not use 192.168.0.0/16. Dual-redundant platform: see §2.3 and IM 30A05C30.
   Vnet/IP open `192.168.<128+domain>.<129+station>`/24; VM remote UI `172.18.<domain>.<station>`/16.
 - Computer name = station name. Check `sc query VLTDI` = RUNNING.
 - Never use Internet Connection Sharing, bridge connections or Homegroup.
-- Run the TCP/IP Inconsistency Detect Tool before installing CI Server (§3.8).
+- Run the TCP/IP Inconsistency Detect Tool before installing CI Server (§3.9).
 
 ### Installing CI Server (§2.1.5)
 
@@ -81,79 +103,185 @@ must not use 192.168.0.0/16. Dual-redundant platform: see §2.3 and IM 30A05C30.
   join the domain first for domain/combination management.
 - Close applications, disable antivirus, never run two installers, never install where CI
   Server Remote Connect is installed.
-- `<DVD>\Windows\CIServer\ciserver-R<ver>-r<build>M-setup.exe` = CI Server only;
+- `<ISO drive>\Windows\CIServer\ciserver-R<ver>-r<build>M-setup.exe` = CI Server only;
   `…-ITSecurity.exe` = CI Server + IT Security Tool (also installs VAGW modules; install type
   *CI Server and IT Security Tool*). Choose the install folder (no spaces if non-default,
-  see known issues), reboot.
+  see known issues). An upgrade keeps the first install folder.
+- Upgrade to R1.05 or later: the installer offers *Automatic upgrade CI Server configuration*
+  (ticked by default). See §3.
+- At the end: tick *I want to set up IT Security Tool Now* for IT security 2.0, untick it
+  for 3.0 (below); then reboot.
 - **Change the initial passwords of the predefined CI Server user accounts** (Engineering
   Module manual).
 
-### IT security (§2.1.6) and licence (§2.1.7)
+### IT security (§2.1.6)
 
-- IT Security Tool: select *Standard Model* and the user management type; keep default items;
-  restart. The model must be the same across the system. Save/export settings if you change
-  defaults. Running the tool (also during upgrade) overwrites manual security changes.
-- Licence: Start menu › *License Authorization Wizard* (admin) › select the activated licence
-  file › Finish.
+The IT Security Tool now offers **IT security version 2.0 or 3.0**. A full list of the 3.0
+settings comes as a PDF with the tool. Common rules:
+- The security model must be the same across the system; linked domain management: apply
+  *Standalone* first, join the domain, then link with the Domain Link Management Tool.
+- Export the settings if you change defaults. Running the tool (also during an upgrade)
+  overwrites security changes made by other means.
+
+**Version 2.0**: at the end of the install keep the checkbox ticked, choose version 2.0,
+*Standard Model*, the user management type, keep default items, restart.
+
+**Version 3.0** (needs a v3.0 licence number per computer, from the licence certificate):
+1. Unblock the ISO file (file properties) so the script runs properly.
+2. Untick the IT Security checkbox at the end of the install.
+3. As administrator run `<ISO drive>\Windows\CIServer\ITSecurity\Installer\ITSec_3_InstalledSoftwareForCIX.cmd`
+   and enter the licence number (up to 20 letters/digits, no hyphens).
+4. Start the IT Security Tool, *Setup*, version 3.0 (Standard model and Standalone are
+   preselected), restart.
+- The GPO file `CIX_Standard_3.0.zip` and the settings PDF are placed under
+  `C:\ProgramData\Yokogawa\IA\iPCS\Platform\Security\GPOFiles\3.0` and `…\Document\3.0`.
+- CI Mobile View or a domain controller: run `ITSec_3_ForCIViewHTML.cmd` or
+  `ITSec_3_DCForCIX.cmd` from the same folder, then `ciserver-…-ITSecurity.exe` with install
+  type *Apply IT Security only*, version 3.0, model *CI View standard Model Standalone Management*.
+
+**Other Yokogawa products on the same PC**: if CI Server is installed after a product that has
+IT security 3.0, CI Server may use 2.0 or 3.0; after a product with 2.0, only 2.0. If the
+other product is installed later, its own supported versions decide (a 2.0-only product
+forces 2.0).
+
+**LAPS** (Local Administrator Password Solution; only with linked domain management and IT
+security 3.0, after the v3.0 GPO is applied to the clients):
+- Install `<ISO drive>\Windows\ThirdParty\LAPS\LAPS.x64.msi`: on the domain controller only
+  the management tools, on the clients only the AdmPwd GPO extension.
+- On the domain controller, as a member of Enterprise Admins and Schema Admins, in an
+  elevated PowerShell: `Import-module AdmPwd.PS`, `Update-AdmPwdADSchema`,
+  `Set-AdmPwdComputerSelfPermission -OrgUnit "<OU>"`. Then enable the policy (Security Guide
+  summary §7).
+- With software restriction policies applied, start the msi from an elevated command prompt.
+
+### Licence (§2.1.7)
+
+Start menu › *License Authorization Wizard* (admin) › select the activated licence file › Finish.
 
 ### CI Server Remote Connect (§2.4)
 
 On a CI View PC (never on a Portal or Core): browse to `http(s)://<portal>:<port>` (defaults
 8080 / 8443), *Download (Windows)*, run `CI-rc-setup.exe`. Portal ports are in `jwuiisg.sup`
 (Setup File Editor › *Client communication* tab); open them in the firewalls.
+- Moving Remote Connect to a later *version* means uninstall, then install the new one; a
+  later revision of the same version can be installed over it.
+- With software restriction policies applied, switch them off before upgrading Remote Connect
+  and on again afterwards.
+- IT security on a Remote Connect PC: run `ciserver-…-ITSecurity.exe` with install type
+  *IT Security for multi-product environment*, then version 2.0 (checkbox) or 3.0
+  (`ITSec_3_InstalledSoftwareForCIViewRC.cmd`, then the tool).
 
 ### Virtualization extras (§2.5)
 
 RD Session Host + RD Licensing (per device) for USB redirection; limit connections to 1;
 allow multiple sessions per user; enable *Windows Audio* and the *System Sound Service* task
-for sound over RDP.
+for sound over RDP. Before applying IT security 3.0 there, set the *Windows Remote Management
+(WS-Management)* service to Automatic and the policy *Allow Remote Shell Access* to Not
+Configured, then restart.
 
 ## 3. Maintenance
 
-**Start/stop (§3.1)**: Start menu › CI Server › *Start CI Server* / *Stop CI Server*, or the
-*CI Service* Windows service (set startup type *Automatic* for automatic start). An expired
-licence gives an error at start.
+**Start/stop CI Server (§3.1)**: Start menu › CI Server › *Start CI Server* / *Stop CI
+Server*, or the *CI Service* Windows service (service name `StartCIServer`; startup type
+*Automatic* for automatic start). An expired licence gives an error at start.
 
-**Reinstall / upgrade (§3.2)**, upgrades from R1.02 or earlier (needs a Product Maintenance
-Licence):
-1. Database consistency: `dsschk`, `dsschk -r`, `dsschk -e`, `dsschk -e -r` (upgrade only).
-2. Stop CI Server; set the CI Service startup type to *Manual*.
-3. Stop the *VAGW Bossd* service, then back up `%TLS_ALLUSERS_PATH%` and `%TLS_ROOT_PATH%\tls`
-   (plus project files).
-4. On the Core (upgrade): delete in `%TLS_SAV_PATH%` `eqp*_main.*`, `eqp*_item.*`, `opx*.*`
+**Start/stop VAGW Bossd (§3.2, new)**: from R1.04, as a `CIX_MAINTENANCE` administrator in an
+elevated prompt: `%TLS_ROOT_PATH%\tls\vagw\program(x64)\vagwstarter.exe -s` (start) or `-e`
+(stop); log in `C:\ProgramData\Yokogawa\IA\iPCS\Products\CENTUMVP\UACS\Server\Log`. On R1.03
+use the Services console. VAGW exists only when installed with the IT Security Tool.
+
+**Reinstall / upgrade (§3.3)**: direct upgrade from R1.01 or later; apply the Product
+Maintenance Licence to the Portal/Core first. If CI Server was installed with the IT Security
+Tool, the reinstall/upgrade must include it too.
+1. (§3.3.1) Note the instance setup files (one per equipment line: equipment process name +
+   `.sup`, Engineering Module › Equipment › Lines) and their templates (Setup File Editor ›
+   *Templates*, `*_eqp.sup` / `*_eqt.sup`; since R1.04 `eqa850_eqp.sup` is `eta850_eqt.sup`).
+2. Database consistency: `dsschk`, `dsschk -r`, `dsschk -e`, `dsschk -e -r` (upgrade only).
+3. (§3.3.3, Vnet/IP on a VM, from R1.01–R1.03 to R1.04+) Set the device of every Vnet line
+   back to `/dev/bk00` in the Engineering Module.
+4. Stop CI Server; set *CI Service* to *Manual*. Stop VAGW Bossd (above) and set it to *Manual*.
+5. Back up `%TLS_ALLUSERS_PATH%` and `%TLS_ROOT_PATH%\tls` (plus project files).
+6. On the Core (upgrade): delete in `%TLS_SAV_PATH%` `eqp*_main.*`, `eqp*_item.*`, `opx*.*`
    (`.sav/.d01/.k01`) and `*.sqlite`.
-5. Note changed setup files (Setup File Editor, *Status* = Changed) and copy
-   `tls\com`, `sup`, `tpl`, `src` and `%TLS_ALLUSERS_PATH%\wap`.
-6. (Vnet/IP) Update drivers (uninstall, reinstall, restart) and network settings.
-7. Install over the top (no uninstall); if IT Security Tool was installed before, install it again.
-8. IT security, licence.
-9. Restore: **compare and merge** changes into the new files (never copy old files over new
-   ones), including `wap\cfg\operatorInterfaces\DEPLOY\layouts\`; re-apply IT security.
-10. Verify: start, `dsschk -e -r` three times, restart, check `%TLS_LOG_PATH%\ci_start.log`,
-    restore the startup type.
-- ODBC: if the Simba client version differs, remove DSNs, uninstall and reinstall the client;
-  on R1.02 or older with the Simba server, uninstall the server before upgrading.
-- Passwords of predefined CI Server accounts are reset to the initial ones: change them again.
+7. Note changed setup files (Setup File Editor, *Status* = Changed) and copy
+   `tls\com`, `sup`, `tpl`, `src`, `exe\ServerConfig.xml` and `%TLS_ALLUSERS_PATH%\wap`.
+8. (Vnet/IP) Update drivers (uninstall, reinstall, restart) and network settings.
+9. Install over the top (no uninstall), keeping the automatic merge ticked unless you want to
+   merge everything by hand.
+10. IT security (version 3.0: run `ITSec_3_InstalledSoftwareForCIX.cmd` first), licence; start
+    CI Server once to confirm, then stop it.
+11. Restore (§3.3.14): check the merge report and conflict log (below) and merge by hand what
+    was not merged. Compare instance setup files with the **new templates** and copy new
+    keywords into each; compare other setup files with the newly installed ones; never copy
+    old files over new ones. Layouts (`wap\cfg\operatorInterfaces\DEPLOY\layouts\`): check
+    them if merged automatically, merge by hand otherwise. Re-apply IT security.
+12. Verify (§3.3.15): start, `dsschk -e -r` three times, stop, start VAGW Bossd, start,
+    check `%TLS_LOG_PATH%\ci_start.log`; from R1.01/R1.02 compile all alarm selection area
+    expressions; restore the startup types (VAGW Bossd back to Automatic).
+- Product-specific upgrade notes live elsewhere: ODBC from R1.02 or older (IM 36K10L45
+  "Notes for upgrading to R1.03.00"), OPC UA client/server (IM 36K10L45 "Notes for upgrading
+  to R1.04.00"), IEC 61850 (IM 36K10L41 App. 1), RGS with EAL from R1.03 (merge the OPC UA
+  client setup file, download the project common section and tag list from the ENG HIS).
+  The R1.03 Simba client/server reinstall notes are no longer in this manual.
+- Passwords of predefined CI Server accounts are reset to the initial ones: change them
+  again (running the IT Security Tool does not reset them).
 
-**HAC upgrade (§3.3)**: stop standby, disconnect its network, upgrade and test offline, stop
-standby, stop primary, reconnect standby and start it, upgrade primary, start it (sync resumes).
+**Automatic merge of configuration files (R1.05+, §2.1.5, §3.3.8, §3.3.14, §3.3.15)**
+- The installer copies user files to `%TLS_ROOT_PATH%\tls\upg\to-<new>\util\backup\user\tls`
+  (`com`, `sup`, and `wap\cfg\operatorInterfaces\DEPLOY\layouts`, `colors`, `chartGroups`)
+  and merges them with the new version.
+- Results: `upgrade-report-<old>-to-<new>-<date>.csv` (columns File name, Attribute, Conf
+  value, Default old, Default new, Merged value, Reason) and `upgrade-conflicts-…log`, in
+  `%TLS_LOG_PATH%\jmrg` (the manual prints the default path).
+- If it did not run: copy the backup `com` and `sup` folders and the three wap folders into
+  that `upg` path, then in an elevated prompt in `%TLS_ROOT_PATH%\tls\com` run
+  `jupgutl.cmd -o <old version> -n <new version> -p "<tls root>" -c "<…\wap\cfg\properties>"`
+  (e.g. `-o 1.04.00 -n 1.05.00`). The text says `-c` is the `jmrgconfig.properties` file but
+  the examples pass its folder; not tested (ISS-086).
+- Verified (R1.05 test server, 2026-10-08): `jupgutl.cmd` starts the Java tool in
+  `tls\exe\jmrg.jar`; `%TLS_WAP_PATH%\cfg\properties\jmrgconfig.properties` limits the merge
+  to `*_start*` / `*_stop*` files in `com`, `*.sup` in `sup` and `*.xml` in the three wap
+  folders; reference copies of the shipped files of R1.01.00–R1.04.00 are in
+  `%TLS_SAV_PATH%\jmrg\ref-data`. Other files (rest of `com`, `tpl`, `src`,
+  `ServerConfig.xml`) still need a manual compare.
 
-**Extend licence (§3.4)**: License Authorization Wizard while running; node name/number must
+**HAC upgrade (§3.4)**: stop standby, disconnect its network, upgrade and test offline, stop
+standby, stop primary, reconnect standby and start it, upgrade primary, start it (sync
+resumes). Keep one server running if several are upgraded at once.
+
+**Extend licence (§3.5)**: License Authorization Wizard while running; node name/number must
 match; takes effect within an hour. New features need CI Server stopped first.
 
-**Uninstall (§3.5, §3.6)**: back up, stop CI Server and VAGW Bossd, Programs and Features ›
+**Uninstall (§3.6, §3.7)**: back up, stop CI Server and VAGW Bossd, Programs and Features ›
 CI Server › Uninstall, restart. Remote Connect: uninstall it, then CI Server (IT Security
-definitions), then run `<DVD>\Windows\CIServer\ITSecurity\DeleteITSecurity.cmd`.
+definitions), then run `<ISO drive>\Windows\CIServer\ITSecurity\DeleteITSecurity.cmd`.
 
-**TCP/IP tools (§3.8)**: from the VirtualProduct package `XCM3003\Module\Tool`:
+**TCP/IP tools (§3.9)**: from the VirtualProduct package `XCM3003\Module\Tool`:
 `TcpipInconsistencyDetector.cmd` (check) and `TcpipInconsistencyRepair.cmd` (resets all NIC
 IPv4 settings: note them first, re-enter after restart).
 
+## 4. Connecting Yokogawa products (new chapter)
+
+- Each combination has an **integration code**: package code 1 – package code 2 – type –
+  revision. Type 01: same PC, no interaction; 02: separate PCs that interact (two type-02
+  products never on one PC); 03: same or separate PCs, working together; 04: as 03 with
+  limits. When manuals of two products disagree, use the one with the newer revision.
+- Security model and user management type must match on both products.
+- **CI Server + PRM Server** (§4.1.1): code 1901-0302-03-01; CI Server R1.04 or later, PRM
+  Server R4.08 or later (a note in the same section says R4.06; ISS-090); Standard model;
+  standalone or domain/combination management; the same IT security version on both.
+  - PRM first: (if VAGW or Vnet/IP is used) remove the Vnet driver with PRM Disc 1 and install
+    the one from the CI Server ISO; run the CI Server + IT Security installer until it
+    restarts; stop PRM with `<OS drive>:\PRM\Tool\PRMStop.bat`; finish the install; set
+    security; restart (PRM services start by themselves).
+  - CI Server first: stop CI Server and VAGW Bossd, set both to Manual, install PRM, restore
+    both startup types.
+
 ## Troubleshooting (Appendix 1)
 
 | Problem | Workaround |
 |---|---|
 | Server Manager error, Microsoft updates fail (80070543), .NET install fails | Temporarily set DCOM Default Authentication Level to *Connect* (revert to *None* afterwards where the manual says so), restart |
 | Cannot manage users in Control Panel | Use Computer Management › Local Users and Groups |
-| Installed updates not listed | `wmic qfe list full` |
-| Cannot change time zone (Server 2019 with UAC) | Run `timedate.cpl` as administrator |
+| Installed updates not listed | Manual: `wmic qfe list full`. WMIC is missing on Windows Server 2025 / 24H2 (verified, R1.05 test server, 2026-10-08): use `Get-HotFix` in PowerShell (ISS-088) |
+| Cannot change the time zone (Server 2019 with UAC) | Run `timedate.cpl` as administrator |
diff --git a/knowledge/manuals/IM36K01C30-01EN.md b/knowledge/manuals/IM36K01C30-01EN.md
index c823aac..c77166d 100644
--- a/knowledge/manuals/IM36K01C30-01EN.md
+++ b/knowledge/manuals/IM36K01C30-01EN.md
@@ -1,31 +1,39 @@
 ---
 manual: IM 36K01C30-01EN
 title: CI Server Security Guide
-edition: 3rd Edition, Sep. 2023
-version: R1.03
-status: from docs (users/groups and firewall checked read-only on the test system)
+edition: 5th Edition, Feb. 2026
+version: R1.05 (first written for R1.03, 3rd Edition, Sep. 2023)
+status: from docs (users/groups and firewall checked read-only on the R1.03 test system; listening ports, users and firewall checked read-only on the R1.05 test server, 2026-10-08; the IT Security Tool is not installed there and not supported on its Windows Server 2025, so IT security itself is not verified on R1.05)
 ---
 
-# CI Server Security Guide (R1.03)
+# CI Server Security Guide (R1.05)
 
 What the IT Security Tool changes, which Windows accounts and firewall openings CI Server
-needs, and the related utilities. Section numbers refer to the manual.
+needs, and the related utilities. Section numbers refer to the 5th edition. Since R1.04 the
+manual covers Windows Server 2022 instead of 2016; R1.05 adds Windows 11 Enterprise LTSC 2024
+and **IT security version 3.0** (§7 below).
 
 ## 1. Threats and measures
 
 - Threats: attacks over the network, direct attacks at a terminal, theft of a computer/data.
 - Measures: access control (files, folders, registry, DCOM/OPC, system commands), personal
-  firewall, stopping unused services, IT environment settings (NetBIOS, disk password), and
-  group policies (password/lockout, security options, software restriction, audit policies,
-  administrative templates, safe DLL search order).
+  firewall, stopping unused services, IT environment settings (NetBIOS, disk password,
+  Delivery Optimization, Defender), and group policies (password/lockout, security options,
+  software restriction, audit policies, administrative templates, safe DLL search order).
 - IT security settings **must** be applied at the area and process levels; business and
   corporate levels follow the site's own policy.
 
 ## 2. Security model and user management
 
 - CI Server supports only the **Standard model**: protects against network and terminal
-  attacks, **not** against theft. Password and lockout policies are *not* set by it (use
-  domain policy).
+  attacks, **not** against theft.
+- Password and lockout (§2.1, §3.6.1–3.6.2): in IT security 2.0 the password policy is not
+  applied (use domain policy), but the **account lockout policy is applied** (10 failed
+  sign-ins, counter reset after 15 min, locked for 15 min). In 3.0 both are settings of the
+  tool; for domain accounts set them on the domain controller or in the Default Domain Policy.
+  (The R1.03 version of this summary said lockout was not set; that was wrong in R1.03 too.)
+- Upgrading from R1.03 or earlier with changed IT security defaults: a dialog asks to reset
+  the lockout values; answer Yes, then set custom values again (IM 36K01A50 §1.3).
 - User management types:
 
 | Type | Accounts kept on | Notes |
@@ -36,7 +44,8 @@ needs, and the related utilities. Section numbers refer to the manual.
 | Linked domain (recommended for new systems) | Domain, linked to local groups | Apply *Standalone* first, join domain, then link with Domain Link Management Tool |
 
 - Groups/accounts created by the IT Security Tool (standalone: local; domain types: on the
-  domain controller, with `_LCL` local helper groups):
+  domain controller, with `_LCL` local helper groups). **With IT security 3.0 only the
+  Standalone and Linked domain sets are created** (§2.2.1).
 
 | Name | Kind | Purpose |
 |---|---|---|
@@ -51,13 +60,21 @@ needs, and the related utilities. Section numbers refer to the manual.
 
 Use these accounts only for CI Server. Changing the security model may delete or rename groups.
 
+Verified (R1.05 test server, 2026-10-08): without the IT Security Tool, CI Server still
+creates the local user `CIX_PROCESS` (member of Administrators) and runs *CI Service* with it;
+there are no `CIX_` groups and no `CTM_PROCESS`. A local group `RDC_GA_CLIENT` with member
+`CIX_PROCESS` also exists although the server is not a dual-redundant platform (ISS-089, no
+action needed).
+
 ## 3. Firewall (§3.2)
 
-Windows Firewall on; block everything except what CI Server needs:
+Windows Firewall on; block everything except what CI Server needs. IT security 3.0 uses the
+same exception list (§3.7.2).
 
 | Use | Port |
 |---|---|
 | Web / secure web (CI View, CI Portal) | TCP 8080 / 80, TCP 8443 / 443 |
+| RESTful API web server (`jrstsrv`, new in R1.04/R1.05) | TCP 34597 (`JRST_NETWORK_PORT` in `jrstsrv.sup`) |
 | DURM between nodes | UDP 17001, 17101 (one per DURM line) |
 | SMDMON (system log collection) | UDP 18002 |
 | Remote desktop (only if needed, restrict users) | TCP 3389 |
@@ -74,15 +91,26 @@ Windows Firewall on; block everything except what CI Server needs:
 
 ICMP echo (ping) is allowed by the Standard model.
 
+Verified (R1.05 test server, 2026-10-08): listening are TCP 8080/8443 (web), 34597 (RESTful
+API), 34493 (OPC UA server `opxuas`), UDP 17001/17101 (DURM) and 18002 (SMDMON). The RESTful
+API server also listens on **TCP 7073** on all interfaces; no manual mentions this port and
+`jrstsrv.sup` has no keyword for it (ISS-087). Do not open it in the firewall.
+
 ## 4. Other settings (§3.3–§3.6)
 
-- Unused services disabled by the tool (depending on OS): Diagnostic Policy, Connected User
-  Experiences and Telemetry, dmwappushsvc, Downloaded Maps Manager, IP Helper, Program
-  Compatibility Assistant, Remote Registry, Shell Hardware Detection, Themes, Windows Push
-  Notifications, and others. DHCP Client must stay running.
+- Unused services disabled by the tool (OS columns now Win10 LTSC, Win11 LTSC 2024, Server
+  2019, Server 2022): Diagnostic Policy, Connected User Experiences and Telemetry,
+  dmwappushsvc, Downloaded Maps Manager, IP Helper, Program Compatibility Assistant, Remote
+  Registry, Shell Hardware Detection, Themes, Windows Push Notifications, and others.
+  Delivery Optimization is no longer stopped; WinHTTP Web Proxy Auto-Discovery left the list.
+  DHCP Client must stay running.
+- Delivery Optimization (§3.5.3): limited by policy (Server 2022: HTTP only; other listed OSs:
+  bypass) so updates do not spread between plant PCs.
+- Defender (§3.5.4): the "turn off" policy is set on OSs older than Windows 11 and left
+  unconfigured on Windows 11; it has no effect on Win10 LTSC 2021 / Win11 LTSC 2024.
 - OPC: *Create permanent shared objects* right for `CIX_OPC`, `CIX_PROCESS`, `CTM_PROCESS`;
   network access sharing model *Classic*; DCOM port range 20500–20550 (the manual's table
-  also prints "2500–20550", taken as a typo).
+  still prints "2500–20550" in R1.05, taken as a typo).
 - NetBIOS over TCP/IP can be disabled (default with domain/combination management); then
   configure HOSTS/DNS for name resolution.
 - USB storage disabled; use the StorageDeviceCTL utility (members of `CIX_MAINTENANCE`) to
@@ -92,14 +120,22 @@ ICMP echo (ping) is allowed by the Standard model.
 
 | Tool | Use |
 |---|---|
-| IT Security Tool (Start › YOKOGAWA Security) | *Setup* (model + management type), *Save*/*Restore* (with a default password for recreated accounts), *Change Password* of the saved file, *Import*/*Export*, *Information* (summary) |
+| IT Security Tool (Start › YOKOGAWA Security) | *Setup* (version 2.0/3.0, model, management type), *Save*/*Restore* (with a default password for recreated accounts), *Change Password* of the saved file, *Import*/*Export*, *Information* (summary) |
 | Domain Link Management Tool | Link/unlink the domain (linked domain management); sign in as local admin + `CIX_MAINTENANCE` |
-| `PrepareReconstruction.cmd` then `ciserver-…-ITSecurity.exe` › *Apply IT Security only* | Re-apply with different target components |
-| `Yokogawa.IA.iPCS.Platform.Security.CreateCIXProcess.exe [-p <password>]` (`<DVD>\Windows\CIServer\ITSecurity`) | Create `CIX_PROCESS` or set its password; same password on all collaborating computers; restart |
+| `PrepareReconstruction.cmd` then `ciserver-…-ITSecurity.exe` › *Apply IT Security only* | Re-apply with different target components (CI Mobile View, General PC, domain controller) |
+| Reapply on Remote Connect after an upgrade to R1.05 | Run the R1.05 `-ITSecurity.exe` installer again to reinstall the IT Security Tool (overwrite install), then apply (§4.8.1) |
+| `ResetITSecCondition.cmd` (`<ISO drive>\Windows\CIServer\ITSecurity`) | First step when switching CI Mobile View, General PC or a domain controller between IT security 2.0 and 3.0 (§4.8.3–4.8.4) |
+| `Yokogawa.IA.iPCS.Platform.Security.CreateCIXProcess.exe [-p <password>]` (`<ISO drive>\Windows\CIServer\ITSecurity`) | Create `CIX_PROCESS` or set its password; same password on all collaborating computers; restart |
 | `…CreateCTMProcess.exe [-p <password>]` | Same for `CTM_PROCESS` |
 | `ITSecuritySettingItemExport.exe` | Export applied settings |
 | `YWVNETCreateVNTUser` | Change passwords of the Vnet/IP Interface Package users (VM) |
 
+Installer options (App. 2.5): *CI Server and IT Security Tool* for CI Core / CI Portal; *IT
+Security for multi-product environment* for CI View / CI Mobile View on a PC where another
+Yokogawa product's IT security is applied; *Apply IT Security only* for CI Mobile View,
+General PC and domain controller (avoid it where other products are installed). Applying the
+wrong station type means reinstalling Windows. Version 3.0 always needs a licence number.
+
 **Changing the account that runs CI Server (§4.9)**: create the user, add it to
 Administrators (and `RDC_GA_CLIENT` on a dual-redundant platform; `CIX_OPC` or
 `CIX_OPC_LCL` when IT security is applied), set it on the *CI Service* Log On tab and on the
@@ -111,4 +147,49 @@ Extra settings the site may add: audit policies and event log sizes, disable rec
 console and Guest account, restrict audit log and removable media access, immediate
 screen-saver password, SNMP, SSL/TLS registry settings, secure startup and
 `AllowedPaths` registry keys, remove *Everyone* for anonymous users, remove unused
-protocols, block malicious DLL loading.
+protocols, block malicious DLL loading, show a notice on entry to a security zone (§5.26).
+
+**Safe API use (§5.27, new)**: give each client application of the APIs (ODBC, OPC UA, web,
+RESTful API, …) its own DSS user or authorization group with only the datasets and the
+read/insert/update/delete rights it needs and a unique password; never run it as SYSTEM or
+with an administrator account. The RESTful API is HTTPS only; use the newest TLS version
+(§5.14). Treat exported data as sensitive and delete what is not needed.
+
+## 7. IT security version 3.0 (new in R1.05)
+
+From docs, not tested (IT Security Tool not available on the R1.05 test server) (§2.1, §3.7, §4.8.3–4.8.4, ch. 6). Installation: Setup summary §2.1.6.
+- Chosen in the IT Security Tool next to 2.0; needs a licence number per computer. The full
+  setting list is a PDF installed with the tool. Settings are grouped in categories (Access
+  Control, Firewall per profile, System Services, Password Policy, Account Lockout Policy,
+  Security Options, Administrative Templates, Removable Storage Access, …); access control,
+  firewall exceptions, OPC, HDD password and software restriction work as in 2.0.
+- Defaults worth knowing:
+  - Unticked by default (tick them on *Select Setting Items* if wanted): screen lock after
+    inactivity, 15-minute limit for idle RDP sessions, password-protected screen saver,
+    SMB signing (Windows 11 signs by default; switch it off on both sides if a product
+    cannot cope).
+  - Ticked by default: Kerberos limited to AES (a domain user may get a "current
+    credentials" prompt; reset that user's password or untick the item), Internet Explorer 11
+    disabled, network level authentication and a single session per RDP user, Print Spooler
+    refuses client connections, no PnP redirection over RDP, auto logon disabled.
+  - PowerShell script-block logging and transcription are on, so a password typed in
+    PowerShell ends up in the log: run security utilities that take passwords in cmd.
+  - CD/DVD access can be denied only with the Group Policy Editor, not with the tool.
+- Built-in accounts (§3.7.18, §3.7.22): disable or rename the built-in Administrator and
+  Guest; avoid names containing admin, root or su; on the dual-redundant platform rename
+  ADMINISTRATOR / PATCHUSER with the Redundancy Management Tool.
+- LAPS (§3.7.23): only with linked domain management and 3.0. After installing it (Setup
+  summary §2.1.6), enable *Enable Local Admin Password Management* in the GPO of the OU of the
+  target computers. The built-in Administrator then gets a different, rotating password on
+  each computer (read it with LAPS UI on the domain controller), so do not use that account
+  for CI Server.
+- Switching CI Mobile View, General PC or a domain controller between 2.0 and 3.0 (§4.8.3–4.8.4):
+  sign in as a `CIX_MAINTENANCE` administrator, run `ResetITSecCondition.cmd`, start the tool
+  and choose the version. Back to 2.0: first *Restore* the file
+  `PrepareToChangeITSecVer.hed` under `C:\ProgramData\Yokogawa\IA\iPCS\Platform\Security\System\Extension\3.0`.
+  For linked domain management, leave the domain, reapply, rejoin and relink.
+- Central management with Active Directory (ch. 6): on the domain controller create a GPO,
+  *Import Settings* from `CIX_Standard_2.0.zip` or `CIX_Standard_3.0.zip` (from
+  `…\ITSecurity\GPOFiles\<version>`; 3.0 comes from the IT security 3.0 medium), and link it
+  to the OU of the CI Server computers. Apply IT security on every client first; change
+  settings only in the GPO on the domain controller.
diff --git a/knowledge/manuals/IM36K10E20-01EN.md b/knowledge/manuals/IM36K10E20-01EN.md
index dd972a2..fb754bf 100644
--- a/knowledge/manuals/IM36K10E20-01EN.md
+++ b/knowledge/manuals/IM36K10E20-01EN.md
@@ -1,17 +1,19 @@
 ---
 manual: IM 36K10E20-01EN
 title: OPC Interface
-edition: 2nd Edition, Sep. 2023
-version: R1.03
-status: from docs; OPC UA point and certificate forms compared with quick load on the test system 2026-10-01 (user configured a point in the Engineering Module, exported and diffed)
+edition: 4th Edition, Feb. 2026 (R1.05); first summarised from the 2nd Edition, Sep. 2023 (R1.03)
+version: R1.05 (first written for R1.03)
+status: from docs. R1.03 (2026-10-01): OPC UA point and certificate forms compared with quick load on the test system (user configured a point in the Engineering Module, exported and diffed). R1.05 (2026-10-08, read-only): method and mapper datasets, installed mapper files, AOG method displays and the ServerConfig.xml location checked; forms not opened, nothing configured
 ---
 
-# OPC Interface (R1.03)
+# OPC Interface (R1.05)
 
-Engineering Module procedures for OPC Classic, OPC UA client and OPC UA PubSub. Concepts,
-setup files and the OPC servers: `IM36K10L45-01EN.md`. Everything here is under
-*Configuration → I/O processing → Equipment → (OPC DA client | OPC A&E client | OPC UA Client |
-OPC UA PubSub)*. CI Server must be running. Section numbers refer to the manual.
+Engineering Module procedures for OPC Classic, OPC UA client, the OPC UA Information Model
+Mapper (new in R1.05) and OPC UA PubSub. Concepts, setup files and the OPC servers:
+`IM36K10L45-01EN.md`. Client and PubSub objects are under *Configuration → I/O processing →
+Equipment → (OPC DA client | OPC A&E client | OPC UA Client | OPC UA PubSub)*. CI Server must be
+running. Section numbers refer to the 4th edition (R1.03 §2.2.6 is now §2.3, PubSub moved from
+ch. 3 to ch. 4).
 
 ## 1. OPC Classic (§1)
 
@@ -19,25 +21,34 @@ OPC UA PubSub)*. CI Server must be running. Section numbers refer to the manual.
   A&E lines, `OPX` for OPC UA), station (OPC server node and ProgID, status item), group
   (deadband, requested update rate, status item), point (external relation, group, OPC tag,
   browse). Then connect items to points (Tutorial "Define points").
-- A&E: line, station (server, subscription filters), subscribed attributes; to show events in
-  the current alarm overview, map event sources to items. External names must be unique per
-  station.
+- A&E: line, station (server, subscription filters; category filter = event category codes of
+  the A&E server, comma separated), subscribed attributes; to show events in the current alarm
+  overview, map event sources to items. External names must be unique per station.
 
-## 2. OPC UA client (§2)
+## 2. OPC UA client (§2.1)
 
 Order: line → station → subscription → points (→ methods) → alarm components / event type
 filters / event nodes / template settings (only when alarms are wanted; no alarms are received
-until event nodes are configured).
+until event nodes are configured, and since R1.04 only with `OPXC_ENABLE_EXTENDED_FUNC = YES`,
+see `IM36K10L45-01EN.md` §6).
 
 | Object | Key fields (dataset field) |
 |---|---|
 | Line | name ≤ 31, equipment node (*None* = this node), **process name starts with `OPX`, ≤ 11 characters** (`EQUIPMENT_MAN`) |
-| Station | name ≤ 19; *Host(:port)* + *Discovery* fill session/server name and endpoint, or type the endpoint (`SERVER_01_ENDPOINT`); redundant servers + *Active server item*; *On scan*; *General communication status item* (`STATUS_ITEM`); security policy and mode; anonymous or user/password; requested session time-out; alarm tab (request active alarms, store all alarms as SOE, severity → priority mapping) |
+| Station | name ≤ 19; *Host(:port)* + *Discovery* fill session/server name and endpoint, or type the endpoint (`SERVER_01_ENDPOINT`); redundant servers + *Active server item* (0 none, 1 server 1, 2 server 2); *On scan*; *General communication status item* (`STATUS_ITEM`; 4th ed. lists 0 preparing, 1 connected, 2 comm error/reconnecting, 3 connect failed, 4 shutdown received, 5 connection recreated — a Boolean item worked on R1.03, ISS-080); security policy and mode; anonymous or user/password; requested session time-out; alarm tab (request active alarms, store all alarms as SOE, severity → priority mapping) |
 | Subscription | publishing interval, lifetime and keep-alive counts, max notifications, priority, publish enabled, status item |
-| Point | external relation Input / Output / Input + Output; subscription; *Namespace*, *Node id type*, *Node Id* (or *Browse path*); read-only *Last value*, *Data type*, *Access level*, *Value rank*; array element; options (own sampling interval, monitoring mode, queue size); conversion (offset, step) |
-| Method | namespace, node ID or browse path, process areas |
+| Point | external relation Input / Output / Input + Output; subscription; *Namespace*, *Node id type*, *Node Id* (or *Browse path*; F5 rebrowses); *Read additional node information* (R1.05; clear it for slow links); read-only *Last value*, *Data type*, *Access level*, *Value rank*; array element; options (own sampling interval, monitoring mode, queue size); conversion (offset, step) |
+| Method (§2.1.6) | name (≤ 255), namespace, node ID type, node ID (or browse path); *Options*: parent object node ID set by hand; *Arguments*: input/output argument types set by hand (use the server's types). Dataset `OPCUAC_METHOD_CALL2_DF`. No process areas any more (set them on the method object's `MTD_TRG` signal) |
 
-**Observed (2026-10-01)**: in the point form's browse, picking the item itself
+Alarm event types (§2.1.4): `GeneralModelChangeEventType` and, only with
+`OPXC_BASE_MODEL_CHANGE_EVENT` set, `BaseModelChangeEventType`.
+
+Upgrade from R1.03 (§2.1.6): methods with String or Boolean input arguments must be refreshed —
+edit any field and Apply (rebrowse), or copy the method, set the arguments, delete the old one
+and add the copy. Running a method needs a CI Server object (IM 36K10L45 5th ed. §10.6; skill
+`data-access`, `opcua-client.md` §7).
+
+**Observed on R1.03 (2026-10-01)**: in the point form's browse, picking the item itself
 (`Objects/<section>/…/<item>`) stores the item **object** (`{"nsid":"<n>"}`), which has no
 value: *Last value*/*Data type* stay empty and the point is never monitored (revised sampling
 interval 0, item status 13). Expanding the item and picking its `Value` node works
@@ -46,26 +57,59 @@ interval 0, item status 13). Expanding the item and picking its `Value` node wor
 STRING). The form also fills `OPC_DISPLAY_NAME` and `OPC_TAG_INFO` (browse bookkeeping;
 not needed for quick load). ISS-033.
 
-## 3. Certificates (§2.2)
+## 3. Certificates (§2.2, §2.3)
 
 *OPC UA Client → Certificates*: **Trusted**, **Rejected** (server certificates arrive here),
 **Own certificate**. Trust = open the rejected certificate, tick *Trusted*, Apply; reject =
 untick. Restart the Engineering Module to refresh the folders. *Modify* the own certificate
 (name, organisation, country, domain or IP, RSA key strength, signature algorithm, validity).
 
-**CI Server OPC UA client ↔ CI Server OPC UA server (§2.2.6)**: trust the server certificate
+New in R1.05 (§2.2): the client warns in the Historical Alarm Overview and the UMH message log
+when its own or the server's certificate is about to expire (lead time = hidden
+`OPXC_CERT_EXP_PERIOD_WARN`, 2 months in the installed `epauac_eqp.sup`, verified 2026-10-08).
+
+**CI Server OPC UA client ↔ CI Server OPC UA server (§2.3)**: trust the server certificate
 on the client; copy the client's own certificate
 (`%TLS_ALLUSERS_PATH%\pki\opxuac\pkiclient\own\certs`) to the server's
 `…\pki\opxuas\pkiserver\trusted\certs`; the manual also asks to tick *Use CI Server entity names
-for nodeids* in `opxuas.sup` and restart the server. On the test system the loopback worked
-**without** that option, using `itnm` node IDs (ISS-032).
+for nodeids* in `opxuas.sup` and restart the server. On the R1.03 test system the loopback
+worked **without** that option, using `itnm` node IDs (ISS-032).
 
-## 4. OPC UA PubSub (§3)
+## 4. OPC UA Information Model Mapper (ch. 3, App. 1; new in R1.05)
+
+From docs; installed parts verified on R1.05 (2026-10-08): dataset `UASERVER_MAPPER_DF`,
+`%TLS_WAP_PATH%\cfg\tools\uamapper\` with libraries `UAMapperLibrary_MDIS`, `_None`,
+`_Use_model`.
+
+- Purpose: publish CI Server data under a standard OPC UA information model (NodeSet file, e.g.
+  MDIS or PA-DIM) instead of, or next to, the native CI Server model (server side:
+  `IM36K10L45-01EN.md` §7).
+- Rights: `UA_MAPPER_PROJECT_INSERT`, `_MODIFY`, `_DELETE` (already in `SYSTEM_MANAGER`).
+- Workflow (*Tools › OPC UA Information Model Mapper*): **New Mapping** (folder
+  `%TLS_WAP_PATH%\cfg\tools\uamapper\mapperprojects\<name>`) → **Configure**: NodeSet file (base
+  models in the same folder) and optional library template → **Edit Rules**: per OPC UA object
+  type a selection query on CI Server objects or sections (`CLASSNAME = …`, `SECTIONNAME = …`;
+  SQL keywords in App. 1), then methods → class names, variables → tag names, events → item or
+  external alarm names → **Build** (results can be exported to / imported from CSV;
+  `MappingReport.txt`) → **Load** to an OPC UA server process. Removing a mapping does not
+  unload it from the server (§3.4.6).
+- Rule-based mapping needs consistent naming or class/object engineering; otherwise map by CSV.
+  In enterprise engineering, map on each CI Core. The manual advises trying a mapping on an
+  extra OPC UA server instance first (§3.4; instance procedure in `IM36K10L45-01EN.md` §7,
+  `<instance>_ServerConfig.xml` in `%TLS_SAV_PATH%`).
+- Dataset `UASERVER_MAPPER_DF`: `NAME`, `DESCRIPTION`, `UA_NAMESPACE`, `UA_MODEL_FILE`,
+  `LIBRARY_NAME`, `MAPPING_FILE`, `TARGET_UA_SERVER`, `PROJECT_STATE` (INIT, CONFIGURED,
+  MAPPED, DEPLOYED).
+
+## 5. OPC UA PubSub (ch. 4)
 
 UDP publish/subscribe of Data Access values from the CI Server OPC UA server address space
-(OPC visible items). Objects: line (needs its own copy of `ServerConfig.xml` named for the
-instance), published datasets, station, writer groups + dataset writers (publisher), reader
-groups + dataset readers (subscriber), then *Upload dataset configurations to runtime*.
-Limits per line: 4 stations, 8 writer groups, 8 reader groups, 32 dataset writers, 32 dataset
-readers, 32 published datasets. Status mapping as for the server (NORMAL → Good; NOT_INIT,
-UPD_OFF, OFFSCAN, OFFLINE → Uncertain; BAD_VALUE → Bad). Not practiced (needs a PubSub peer).
+(OPC visible items). Needs `OPXUAS_ENABLE_EXTENDED_FUNC = YES` since R1.04
+(`IM36K10L45-01EN.md` §7). Objects: line, published datasets, station, writer groups + dataset
+writers (publisher), reader groups + dataset readers (subscriber), then *Upload dataset
+configurations to runtime*. Each extra PubSub line needs its own OPC UA server instance named
+like the line's server name (own `<instance>_ServerConfig.xml`, which R1.05 keeps in
+`%TLS_SAV_PATH%` — R1.03: `tls\exe`; ISS-081). Limits per line: 4 stations, 8 writer groups,
+8 reader groups, 32 dataset writers, 32 dataset readers, 32 published datasets. Status mapping
+as for the server (NORMAL → Good; NOT_INIT, UPD_OFF, OFFSCAN, OFFLINE → Uncertain; BAD_VALUE →
+Bad). Not practiced (needs a PubSub peer).
diff --git a/knowledge/manuals/IM36K10L40-01EN.md b/knowledge/manuals/IM36K10L40-01EN.md
index 3e7d3a4..709c81a 100644
--- a/knowledge/manuals/IM36K10L40-01EN.md
+++ b/knowledge/manuals/IM36K10L40-01EN.md
@@ -1,12 +1,12 @@
 ---
 manual: IM 36K10L40-01EN
 title: EQUIPMENT Service Engineering - Utilities
-edition: 3rd Edition, Sep. 2023
-version: R1.03
-status: from docs; installed programs, setup file and start scripts checked, eqpdbg "Get main info" run read-only on the test system (2026-09-30)
+edition: 4th Edition, Feb. 2026 (R1.05); content unchanged since the 3rd Edition, Sep. 2023 (R1.03): the revision table lists contact information only
+version: R1.05 (first written for R1.03)
+status: from docs; installed programs, setup file and start scripts checked, eqpdbg "Get main info" run read-only on the R1.03 test system (2026-09-30); on the R1.05 test server files and tool menus checked read-only (2026-10-08); eqpdbg "Get main info" run read-only on R1.05 too (2026-10-08); EQT tools not tested (no EQT line)
 ---
 
-# EQUIPMENT Service Engineering - Utilities (R1.03)
+# EQUIPMENT Service Engineering - Utilities (R1.05)
 
 Three utilities of the EQUIPMENT Service (the equipment managers `eqp<type>` that talk to
 stations). Section numbers refer to the manual.
@@ -37,6 +37,13 @@ normally read hourly.
      1220 Fisher ROC, 1316 HexRepeater, 1636 IEC 61850.
    - Scan rate number: the points' scan interval in ms, or the driver's internal rate number.
 5. Restart CI Server (or the `EQPFRCSCN` process).
+
+**R1.04 and later:** IEC 61850 (and IEC 104) lines run under an EQT manager, which
+`eqpfrcscn` does not reach. The forced scan for them is `eqtfrcscn`: its template
+`tls\tpl\eqtfrcscn.tpl` has the same `FORCE` / `FCX_EVENT` / `queue_size` keywords and I/O type
+list, with the EQT node and process as arguments. R1.05 installs no `eqtfrcscn.sup`; an
+`eqtfrcscn_start.cmd` in `tls\com` would start it, because `equipment_start.cmd` runs
+`eqt*start.cmd`. The manual does not describe it (ISS-078; checked from files only, not tested: no EQT line on the R1.05 test server).
 Example: a change of the trigger item makes 60 s points scan every 10 s for 600 s.
 Long scan intervals can let an RTU close its TCP socket; keep at least one faster item or
 lengthen the RTU's socket timeout.
@@ -52,6 +59,9 @@ sends, good answers, bad return code, timeouts, frame errors, bad CRC, retries,
 (`NAME` = `<DD-MON-YY hh:00>/<station>/<line>`), e.g. `CIENG_PLC` with `TIMESPAN` (seconds
 counted in that hour), `SENDS` and `GOODANS` 1560/1560. Only stations that actually sent requests
 appear; the first export (no communicating station) was empty (ISS-021). History type 4.
+R1.05 also installs `eqtiostat` for EQT managers, but its start line in `equipment_start.cmd`
+is commented out (checked 2026-10-08); whether IEC 104/61850 stations reach `STATION_STAT` is
+not checked.
 
 ## 3. Debugger: `eqpdbg` (§3)
 
@@ -79,10 +89,28 @@ printf '1\n-1\n' | eqpdbg 0 EQPMDC
 
 Test system: `eqpdbg 0 EQPMDC` main info showed line type 107, both lines attached, 100 ms
 scan interval, 2 slaves, 2 % line load.
+R1.05 test server (2026-10-08): same tool, prompts and output layout: line type 107, lines 0 and 1
+attached, 100 ms, ON_SCAN, 1 slave, criterion mask 0x000D, 0 % line load; `-1` exits.
 
-## Installed on the test system
+**`eqtdbg`** (R1.04 and later) is the same debugger for EQT managers: default process `EQT`,
+same action numbers −2…23 (menu strings read from both programs on R1.05, 2026-10-08; not
+run). Use the line's equipment process name, e.g. `EQT850`. Not in the manual (ISS-078).
+
+## Installed on the R1.03 test system
 
 Many drivers `tls\exe\eqp<type>.exe` (e.g. `eqpmdc` Modbus, `eqpfcx` STARDOM, `eqpfam3` FA-M3,
 `eqp850` IEC 61850, `eqpdnp` DNP3); setup files `eqp*.sup` (e.g. `eqpmdc.sup`, `eqpmqtt.sup`,
 `eqpfrcscn.sup`); start scripts `eqpmdc_start.cmd`, `eqpmqtt_start.cmd`. Running managers:
 `eqpmdc`, `eqpmqtt`, `eqpiostat`.
+
+## Installed on the R1.05 test server (2026-10-08)
+
+Program and data under `C:\Yokogawa\CIServer`. `eqp104`, `eqp850` and `eqp850dmp` are gone;
+instead `eqt104`, `eqt850`, `eqt850dmp`, `eqtdbg`, `eqtfrcscn`, `eqtiostat`, `etaman` and the
+data servers `eta10464.dll` / `eta85064.dll`. Setup files `eqtini.sup` (licence only),
+`eta.sup` (protocols run by the EQT framework: `iec61850`, `iec104`), `eta104*.sup`,
+`eta850*.sup`, client file `eqt850.icd`; templates `eqtfrcscn.tpl`, `eqtini.tpl`.
+`equipment_start.cmd` starts `etaman` after `epaman` and runs `eqt*start.cmd`;
+`equipment_stop.cmd` stops `eta*` and `eqt*`. Running: `epaman`, `etaman`, `eqpmdc`,
+`eqpmqtt`, `eqpiostat`. Modbus files (`eqpmdc.sup`, `epamdc*.sup`, `eqpfrcscn.sup`/`.tpl`) are
+identical to R1.03.
diff --git a/knowledge/manuals/IM36K10L41-01EN.md b/knowledge/manuals/IM36K10L41-01EN.md
index adea046..90b22b1 100644
--- a/knowledge/manuals/IM36K10L41-01EN.md
+++ b/knowledge/manuals/IM36K10L41-01EN.md
@@ -1,12 +1,12 @@
 ---
 manual: IM 36K10L41-01EN
 title: EQUIPMENT Service Engineering - Configuration
-edition: 3rd Edition, Sep. 2023
-version: R1.03
-status: from docs; general parts (§1–3.5) and Modbus (§3.6–3.7) summarized in detail, other drivers as a table; Modbus datasets, eqpmdc.sup and save files checked read-only on the test system (2026-09-30)
+edition: 5th Edition, Feb. 2026 (R1.05); first written from the 3rd Edition, Sep. 2023 (R1.03). Changed since: R1.04 §3.4.5/3.4.7/3.4.8, 3.12.2, 3.15, 3.32, 3.40, App. 1 new; R1.05 §3.32, App. 1.3, App. 1.4 new
+version: R1.05 (first written for R1.03)
+status: from docs; general parts (§1–3.5) and Modbus (§3.6–3.7) summarized in detail, other drivers as a table; Modbus datasets, eqpmdc.sup and save files checked read-only on the R1.03 test system (2026-09-30); R1.05 changes added from the 5th Edition and checked read-only on the R1.05 test server (2026-10-08): Modbus datasets and setup files identical to R1.03
 ---
 
-# EQUIPMENT Service Engineering - Configuration (R1.03)
+# EQUIPMENT Service Engineering - Configuration (R1.05)
 
 How CI Server exchanges data with PLCs, RTUs and other systems: lines, stations, scan types,
 points and conversion types, then one chapter per protocol. Section numbers refer to the
@@ -19,7 +19,9 @@ manual. Utilities (forced scan, statistics, debugger): `IM36K10L40-01EN.md`.
 - One **plug-in per protocol**: an equipment manager process (e.g. `EQPMDC` for Modbus
   master), its setup file, shared libraries and datasets for line, station, scan type and point.
 - **Defining a line** copies the protocol's template setup file (e.g. `eqpmdc.sup`) and starts
-  an equipment manager instance. The name is free but must start with `eqp`.
+  an equipment manager instance. The name is free but must start with `eqp`; for IEC 60870-5-104 and IEC 61850 (R1.04
+  and later) it starts with `eqt` (defaults `EQT104`, `EQT850`; §3.32.1, App. 1.3; for 104 the
+  manual still says `eqp104`, ISS-076).
 - Each manager keeps two private save files in `%TLS_SAV_PATH%`: `<process>_MAIN.sav`
   (lines/stations) and `<process>_ITEM.sav` (points), only to start fast. Deleting them loses
   the runtime configuration; repair with `dsschk`. (Test system: `eqpmdc_main.sav`,
@@ -163,7 +165,7 @@ start file is enough (see L40 summary).
 | 3.12 | VNET | Vnet/IP | needs Vnet/IP set up (not on Windows 10 test PC) |
 | 3.13 | Host-Host Coupling (`EQPHHC`) | MDUR to another CI Core | read/write points of a remote CI Server |
 | 3.14 | FA-M3 | TCP/IP | |
-| 3.15 | MELSEC | EZSocket (TCP/IP, UDP, serial) | EZSocket must be installed |
+| 3.15 | MELSEC | EZSocket (TCP/IP, UDP, serial) | EZSocket must be installed: installer on the install media (`\Windows\EZSocketPcRedistributableInstaller`), run as administrator; fails if CI Server is not in the default location or its path has spaces (R1.04) |
 | 3.16 | DAQSTATION | TCP/IP | DX, CX, MW100, GX/GP/GM |
 | 3.17 | Beckhoff BK8100 | serial / terminal server | |
 | 3.18 | Allen Bradley PLC5 | DH+ via ControlLogix DHRIO, or DF1 serial/terminal server | BCC checksum only |
@@ -176,15 +178,59 @@ start file is enough (see L40 summary).
 | 3.25 | HART router | serial in, terminal server out | re-issues HART commands to a multiplexer |
 | 3.26 | Hex repeater | terminal server | RTU models in `hxr_model.sup` |
 | 3.27 | TIE 870-5 | serial | |
-| 3.28–3.31 | IEC 60870-5-101 / 102 / 103 / 104 | serial or TCP/IP (104: TCP/IP) | |
-| 3.32 | IEC 61850 | TCP/IP | scan reads; direct write and control models |
+| 3.28–3.31 | IEC 60870-5-101 / 102 / 103 / 104 | serial or TCP/IP (104: TCP/IP) | 104 on R1.04+: manager `EQT104`, template `eta104_eqt.sup` with an undocumented `quality_code_parsing` switch (ISS-076, ISS-077) |
+| 3.32 | IEC 61850 | TCP/IP | manager `EQT850` on R1.04+: polling or IEC 61850 reports, report control blocks; see below |
 | 3.33–3.34 | WITS level 0 slave / master (`EQPWITS`, `EQPWITSWR`) | serial / terminal server | drilling data |
 | 3.35 | STX-Bachmann | Modbus to STX PLC | event buffer extension |
 | 3.36 | DTS | Modbus TCP + (S)FTP WITSML | stores in history group `DTS_DATA`; `EQPDTSDBG` |
 | 3.37 | AC-Gateway | ASCII subset (BK, SI, FG, FS) | |
 | 3.38 | Bachmann | M1COM library | |
 | 3.39 | Omron FINS | UDP | CIO, WR, HR, AR, DM areas |
-| 3.40 | Beckhoff ADS | TwinCAT 3 router | |
+| 3.40 | Beckhoff ADS | TwinCAT 3 router | TwinCAT 3 Build 4024 or later (R1.04; was 3.1.4022.2) |
+
+### 3.32 IEC 61850 on R1.04 and later
+
+From docs (5th Edition §3.32) unless marked; installed files checked on the R1.05 test server
+(2026-10-08).
+- **Order:** line, setup file, stations, I/O points, then report control blocks. Give the IED
+  engineer the client file `tls\sup\eqt850.icd` once per project (installed on R1.05). The
+  manual names the client `EQP850` in one place and `EQT850` elsewhere (ISS-079).
+- **Station:** `DOMAIN_PREFIX` = logical-device name put in front of every I/O address (no
+  "/"); default port 102. The old station field `REPORTS` is hidden on R1.05; on upgrade its
+  content becomes report control blocks `RCB10`…`RCB50`.
+- **Points:** `IO_ADDRESS`, `TIMESTAMP_ADDRESS`, `QUALITY_ADDRESS` up to 139 characters
+  (field length 140 on R1.05, 130 on R1.03). No prefix = polled; prefix `R:` = taken from a
+  received report. All three addresses of a point must be in the same report data set, and
+  `R:` addresses must be unique. Arrays as `[n]`, n 0–9999. Scan types Slow / Medium / Fast /
+  Event; `DATA_TYPE` default Automatic.
+- **Quality:** bits 0–12 carry the IEC 61850 quality. With a control model, bits 13–31 of the
+  item quality report Select / Operate / Cancel, `stSeld`, AddCause and command termination
+  (timeout `operTimeout`, default 60000 ms). A failed write to a report-sourced item sets BAD
+  VALUE and sends a general interrogation to all report control blocks of the station.
+- **Report control blocks, dataset `IEC61850_RCB_DF`** (new; fields checked on R1.05): `NAME`
+  = `<station>:<rcb name>`, `STATION`, `RCB_NAME`, `DESCRIPTION`, `RCB_IO_ADDRESS` (required),
+  `STANBY_RCB_BLOCKS`, `STANBY_RCB_IO_ADDRESS` (spelled this way), `CONNECTION_TIMEOUT` (default
+  5000 ms), `IS_DYN_SETTABLE_OPTFLDS` (default 1; set optional fields dynamically only when the
+  IED's SCL file allows it). Trigger options dchg, qchg, dupd, integrity, GI; `RptID` unique per
+  block; the EntryID lets the client resume after a reconnect.
+- **Setup file `eqt850.sup`** (template `eta850_eqt.sup`, checked on R1.05): `crit` default
+  `8D` (adds the quality criterion); new switch `select_oper_internal = Y|N` (default N; Y
+  keeps the R1.03 behaviour of an internal Select).
+
+## Appendix 1: upgrade precautions (R1.04 and later)
+
+From docs (5th Edition App. 1.1–1.4).
+- **From R1.03 with IEC 61850 configured:** the line's process name changes automatically from
+  `EQP…` to `EQT…`, but the instance setup file is not renamed: rename `eqp850.sup` to
+  `eqt850.sup` and merge it with the new template `eta850_eqt.sup` (old `epa850_eqp.sup`); rename
+  and edit `tls\com\eqp850_start.cmd` / `_stop.cmd` to `eqt850_*` with `eqt850.exe` / `EQT850`.
+  This can be done by hand or with `%TLS_ROOT_PATH%\tls\com\jupgutl` (log in
+  `%TLS_LOG_PATH%\jmrg\`); it is not needed when *Automatic upgrade CI Server configuration* was
+  chosen during setup.
+- No precautions for R1.01→R1.02, R1.02→R1.03 or R1.04→R1.05. IEC 104 is not mentioned
+  (ISS-076).
+- §3.4.5, 3.4.7, 3.4.8 (STARDOM FCX, VNET and CENTUM status words) were rewritten as tables of
+  item statuses; the mapping did not change.
 
 ## Test system (read-only, 2026-09-30)
 
diff --git a/knowledge/manuals/IM36K10L45-01EN.md b/knowledge/manuals/IM36K10L45-01EN.md
index 06e048a..fad3cac 100644
--- a/knowledge/manuals/IM36K10L45-01EN.md
+++ b/knowledge/manuals/IM36K10L45-01EN.md
@@ -1,17 +1,19 @@
 ---
 manual: IM 36K10L45-01EN
 title: Data Access Engineering
-edition: 3rd Edition, Sep. 2023
-version: R1.03
-status: from docs; installed setup files (odbsrv.sup, opxsys.sup, opxuas.sup, ServerConfig.xml), access_start.cmd, PKI folders, processes and ports checked 2026-10-01; OPC UA client → own OPC UA server loopback verified with CI-Eng-Sample (station CIENG_UA); ODBC not working on the test system (ISS-008); OPC DA/A&E from docs
+edition: 5th Edition, Feb. 2026 (R1.05); first summarised from the 3rd Edition, Sep. 2023 (R1.03)
+version: R1.05 (first written for R1.03)
+status: from docs. R1.03 (2026-10-01): installed setup files (odbsrv.sup, opxsys.sup, opxuas.sup, ServerConfig.xml), access_start.cmd, PKI folders, processes and ports checked; OPC UA client → own OPC UA server loopback verified with CI-Eng-Sample (station CIENG_UA). R1.05 (2026-10-08, read-only on the test server): setup files (opxuas.sup, opxsys.sup, epauac_eqp.sup, opxuac_mon.sup, odbsrv.sup, dbc.sup, jrstsrv.sup, dssana.sup), ServerConfig.xml, PKI folders, processes, ports, data dictionary and dataset definitions compared with R1.03; loopback not re-run. ODBC not working on either system (ISS-008); OPC DA/A&E, RESTful API calls, methods and the imported information model from docs
 ---
 
-# Data Access Engineering (R1.03)
+# Data Access Engineering (R1.05)
 
-ACCESS Service connects CI Server data to other software: **ODBC** (SQL on datasets), **OPC
-Classic** (DA and A&E, client and server, DCOM) and **OPC UA** (client and server). Section
-numbers refer to the manual. Engineering Module forms: `IM36K10E20-01EN.md`. Hands-on:
-skill `data-access`.
+ACCESS Service connects CI Server data to other software: **ODBC** (SQL on datasets), the
+**RESTful API** (R1.04+), **OPC Classic** (DA and A&E, client and server, DCOM) and **OPC UA**
+(client and server). Section numbers refer to the 5th edition. R1.04 inserted ch. 4 (RESTful
+API), so OPC chapters moved up by one compared with R1.03 (R1.03 §4–§10 = R1.05 §5–§11; in the
+OPC UA client chapter R1.03 §9.5–9.11 = R1.05 §10.7–10.13). Engineering Module forms:
+`IM36K10E20-01EN.md`. Hands-on: skill `data-access`.
 
 ## 1. ODBC (§1–§3)
 
@@ -22,23 +24,26 @@ skill `data-access`.
 - `odbsrv.sup`: `PORT` (1583), `USESSL` (default on; certificate
   `%TLS_ROOT_PATH%\tls\pki\odbsrv\SampleServerCertificate.pem`, key `SampleServerKey.pem`),
   `REMOVE_PADDING_SPACES`, trace (`TRACE`, `VERBOSE`, `TRACE_FILE`), hidden data
-  (`TABLE_SUPPRESSION`, `FIELD_SUPPRESSION`, `FIELD_CONCEAL`, all on).
+  (`TABLE_SUPPRESSION`, `FIELD_SUPPRESSION`, `FIELD_CONCEAL`, all on). Unchanged in R1.05
+  (verified).
 - Client: install the VC++ 2019 redistributable and `SimbaClientDriverxx.zip` from the medium
   (`install.bat` as administrator); define a DSN with driver `CiSimbaClientDriver` (64-bit) or
-  `CiSimbaClientDriver32`, server IP and port 1583. Before R1.03, uninstall the old Simba parts.
+  `CiSimbaClientDriver32`, server IP and port 1583. SimbaServer is installed and removed with
+  CI Server (§3.2). Delete the DSN when ODBC is no longer used. Removing Simba parts from
+  before R1.03 is now in App. 1.2.
 - SQL wildcards `%`/`_` vs. MS Office `*`/`?`: escape `_` and `%` in names with `\`.
 - Common errors (§2.3): IM003 driver missing; IM002 DSN unknown; 08S01 SimbaServer not
   running / port mismatch / BUS Service not reachable.
 
-**Installed (test system)**: `odbsrv.sup` `PORT 1583`, `USESSL YES`, but the folder
-`%TLS_ROOT_PATH%\tls\pki\odbsrv` does not exist and no sample certificate is shipped, so
+**Installed (R1.03 and R1.05 test systems)**: `odbsrv.sup` `PORT 1583`, `USESSL YES`, but the
+folder `%TLS_ROOT_PATH%\tls\pki\odbsrv` does not exist and no sample certificate is shipped, so
 `odbsrv` stops at every start (`CppServerAPI::Run() failed: InitializeSslCtx():
 SSL_CTX_use_certificate_chain_file() failed`, then `DUR-W-REM_PROC, Process ODBSRV exited
 unexpectedly`); port 1583 does not listen. Fix: put a certificate and key there, or set
 `USESSL = NO` (admin; not applied, ISS-008). `access_start.cmd` writes the ODBC registry
 defaults once (when `%TLS_DAT_PATH%\access.new` exists).
 
-## 2. OPC Classic basics (§4)
+## 2. OPC Classic basics (§5)
 
 DCOM-based, Windows only. CI Server has DA client (`opxdac`), DA server (`opxdas12`, DA 1.0A
 and 2.0, custom + automation interfaces), A&E client (`opxaec`), A&E server (`opxaes`).
@@ -51,7 +56,7 @@ and 2.0, custom + automation interfaces), A&E client (`opxaec`), A&E server (`op
 - Items, sections and objects appear to OPC servers (DA, A&E **and UA**) only with *OPC
   visible* (and every parent section visible).
 
-## 3. OPC DA client (§5)
+## 3. OPC DA client (§6)
 
 - One client process per DA line (name given in the line), started/stopped with CI Server;
   stop one with `durstp -msk -t10 -p <client>`. Uses a save file in `%TLS_SAV_PATH%` named
@@ -59,22 +64,22 @@ and 2.0, custom + automation interfaces), A&E client (`opxaec`), A&E server (`op
 - Server check every `OPXDAC_SRV_ALIVE` ms (default 30000); station status item: 1 running,
   2 failed, 3 no config, 4 suspended, 5 test. Not connected → mapped items OFFLINE. Group
   status item: 1 active / 0 not active (items offline).
-- Setup (`<client>.sup`, else `opxsys.sup`): `OPXDAC_SAFE_CON` (allow connecting to a CI Server
-  DA server — **never to the own node or a DURM-connected node: deadlock**), `OPXDAC_PING`
-  (ICMP check before DCOM, fast failure), `…_PING_TIMEOUT` (3 s), `…_DUR_QSZ`, `…_HBEAT`
-  (100 ms), `…_ITMBUF`, `…_FLUSH_GRPQUE` (500 ms), `…_BROWSE_CACHE`, `…_DISABLE_BROWSING`,
-  `…_CHECK_MAPPING`, `…_ASYNC_WRITE`, `…_USE_CANONICAL_DATA_TYPE` (default asks VT_R8),
-  `…_IGNORE_BAD_QC_UPDATES`, `…_CLEAR_SAV_FILE`, `…_DISABLE_STATUS_UPDATE`.
+- Setup (`<client>.sup`, else `opxsys.sup`; §6.3): `OPXDAC_SAFE_CON` (allow connecting to a
+  CI Server DA server — **never to the own node or a DURM-connected node: deadlock**),
+  `OPXDAC_PING` (ICMP check before DCOM, fast failure), `…_PING_TIMEOUT` (3 s), `…_DUR_QSZ`,
+  `…_HBEAT` (100 ms), `…_ITMBUF`, `…_FLUSH_GRPQUE` (500 ms), `…_BROWSE_CACHE`,
+  `…_DISABLE_BROWSING`, `…_CHECK_MAPPING`, `…_ASYNC_WRITE`, `…_USE_CANONICAL_DATA_TYPE` (default
+  asks VT_R8), `…_IGNORE_BAD_QC_UPDATES`, `…_CLEAR_SAV_FILE`, `…_DISABLE_STATUS_UPDATE`.
 - Advice: one OPC server per client process (a DCOM time-out blocks the whole process).
   Quick-load templates: export `LINE_DF`, `STATION_DF`, `OPC_GROUP_DF`, `ITEM_DF`,
   `POINT_DF` of one station made in the Engineering Module.
-- **DCOM tunnelling**: run the client on a PC in the OPC server's domain (CI Server with BUS,
-  DATABASE, EQUIPMENT, ACCESS licence) connected to the host by MDUR (`durm_<n>_udp.sup`,
-  port ≥ 20000, `dur.sup` host node = CI Core), *use DCOM tunnelling to host* on the client's
-  setup file; on the host add the line with *Equipment node* = tunneller node. Use `intmon`
-  node monitoring with *Set slave items offline when node unavailable*.
+- **DCOM tunnelling** (§6.6): run the client on a PC in the OPC server's domain (CI Server with
+  BUS, DATABASE, EQUIPMENT, ACCESS licence) connected to the host by MDUR
+  (`durm_<n>_udp.sup`, port ≥ 20000, `dur.sup` host node = CI Core), *use DCOM tunnelling to
+  host* on the client's setup file; on the host add the line with *Equipment node* = tunneller
+  node. Use `intmon` node monitoring with *Set slave items offline when node unavailable*.
 
-## 4. OPC DA server (§6)
+## 4. OPC DA server (§7)
 
 - COM server `opxdas12.exe`, ProgID `Yokogawa.CIOpcDas.<version>`, DUR name `OPXDAS`; started by
   COM on the first client connect; stop with `durstp -p opxdas` (clients get a shutdown).
@@ -90,11 +95,11 @@ and 2.0, custom + automation interfaces), A&E client (`opxaec`), A&E server (`op
   `secpol` (*Create permanent shared objects*, *Network access: Classic*), firewall rules for
   `opxdas12.exe`, `opxdac.exe`, `opcenum.exe`, `mmc.exe` and DCOM — not needed where the IT
   Security Tool is applied. Same account/password on both sides in a workgroup.
-- Troubleshooting: `OCSRegistryCheck.exe` (GUI; installed), `opxdas12 /RegServer`,
+- Troubleshooting (§7.9): `OCSRegistryCheck.exe` (GUI; installed), `opxdas12 /RegServer`,
   `opccommonsetup` / `opcenum /RegServer` / `opcenum /Service` (set the service to automatic),
   `regsvr32 opcproxy.dll` and `opccomn_ps.dll` in `%WINDIR%\SysWOW64`. Test locally first.
 
-## 5. OPC A&E client and server (§7, §8)
+## 5. OPC A&E client and server (§8, §9)
 
 - Client `opxaec` (default name `OPXAEC`, `-n` for more), setup `<name>.sup` or `opxsys.sup`
   (`OPXAEC_SAFE_CON` — same deadlock rule, `…_DUR_QSZ`, `…_SRV_ALIVE`, `…_PING_TIMEOUT`,
@@ -104,89 +109,162 @@ and 2.0, custom + automation interfaces), A&E client (`opxaec`), A&E server (`op
   `…_ALM_REC_DELAY` (30 s), `…_BROWSE_PREP_INI`, and `OPXAES_EC_ATTR_*` switches for the
   CI Server-specific event attributes (old/new value, quality, status, alarm state, item
   description, units, node, group, number, sub-number). Installed: all on.
+- Installed R1.05 only (verified 2026-10-08, not in the manual, ISS-085): `OPXAES_DIR_ALM`
+  (YES) switches "Direct" alarm events of the A&E server.
 
-## 6. OPC UA client (§9)
+## 6. OPC UA client (§10)
 
 - OPC UA TCP only; security by X.509 certificates (application authentication), user
   anonymous or name/password; modes None/Sign/SignAndEncrypt; policies Basic256Sha256,
   Aes128-Sha256-RsaOaep, Aes256-Sha256-RsaPss recommended (None, Basic128Rsa15, Basic256 not).
-- Data types supported: Boolean, (S)Byte, (U)Int16/32, Float, Double, String and others as in
-  Table 9.4.2-2; 1-D and 2-D arrays by element. OPC UA status → CI Server quality: 0 good,
-  1 bad, 2 uncertain.
-- A&C: external alarms from ConditionType and derived types (ALARM/NORMAL events), other
+- Data types (§10.3.4, new in R1.04): Boolean → Boolean; SByte, Byte, Int16, UInt16, Int32,
+  Integer → Integer; UInt32, Int64, UInt64, Float, Double, Number, UInteger, Duration → Real; String, ByteString,
+  LocalizedText, DateTime / UtcTime (only `YYYY-MM-DDThh:mm:ss.sssZ`) → String of up to 250
+  bytes; ExtensionObject only for EURange and EngineeringUnits; enumerations as Int32. Unsigned
+  types take no negatives, 64-bit types no decimals. One array element per point (methods take
+  no arrays). A failed conversion is logged and the item gets status Bad. OPC UA status →
+  CI Server quality: 0 good, 1 bad, 2 uncertain.
+- A&C (§10.4): **only with `OPXC_ENABLE_EXTENDED_FUNC = YES`** in the client's setup file (R1.04+,
+  default NO). External alarms from ConditionType and derived types (ALARM/NORMAL events), other
   events INFORMATIONAL; filters by event type, component, event node; severity → priority
-  table (901–1000 → 1 … 1–100 → 15), per station; don't manage
-  NonExclusiveLimitAlarmType. Only `NodeDeleted` model changes are handled.
-- Redundancy: no client redundancy (use HAC); servers: transparent, or non-transparent cold
-  backup with two endpoints (*Active server item* 0/1/2).
-- Engineering objects: line (starts a client process; **name must start with `OPX`**, max 11
-  characters), station (= session), subscription, point (= monitored item), alarm component /
-  event type filter / event node / template settings, method.
-- Certificates: the client process creates `<host>_<PROCESS>.der` in
+  table (901–1000 → 1 … 1–100 → 15), per station; don't manage NonExclusiveLimitAlarmType.
+- Model change events (§10.5, R1.04): `GeneralModelChangeEvent` is handled per change type —
+  node/reference added: the affected points are recreated; node/reference deleted: the linked
+  items go offline and external alarms get a ConditionRefresh; data type changed: nothing.
+  `BaseModelChangeEvent` (no detail; recreate all points and event nodes) only with
+  `OPXC_BASE_MODEL_CHANGE_EVENT = YES` (default NO). Bursts within 10 s are handled once,
+  handling waits during alarm floods, and the server must support Read and Browse.
+- Methods (§10.6, R1.04): a CI Server object per method with attribute `MTD_KEY` and signals
+  `MTD_TRG`, `MTD_RET`, `MTD_IN_ARG_n`, `MTD_OUT_ARG_n` (≤ 10 each; sample Java class
+  `UAC_MTD_JBASE`); a method record per station and one point (namespace and node ID
+  `CIX_UAC_MTD`, Input + Output) connected to `MTD_TRG`; symbol/display (demo
+  `AOG_UAC_Method_Demo`). Dataset `OPCUAC_METHOD_CALL2_DF` (R1.03: `OPCUAC_METHOD_CALL_IN_DF` /
+  `…_OUT_DF`, removed). Procedure: skill `data-access`, `opcua-client.md` §7.
+- Redundancy (§10.7): no client redundancy (use HAC); servers: transparent, or non-transparent
+  cold backup with two endpoints (*Active server item* 0/1/2).
+- Engineering objects (§10.9): line (starts a client process; **name must start with `OPX`**,
+  max 11 characters), station (= session), subscription, point (= monitored item), alarm
+  component / event type filter / event node / template settings, method. The station's
+  communication status item is called Boolean in §10.9.2, but IM 36K10E20 4th ed. lists states
+  0–5 (ISS-080).
+- Certificates (§10.9.10): the client process creates `<host>_<PROCESS>.der` in
   `%TLS_ALLUSERS_PATH%\pki\opxuac\pkiclient\own\certs` (also listed in dataset
-  `OPCUAC_PKI_CERTIFICATES_DF`); server certificates arrive in `…\pkiclient\rejected` and must be
-  trusted (Engineering Module, or move to `…\pkiclient\trusted\certs`); folders `deleted`,
-  `rejected` added by CI Server. The server must trust the client's certificate too.
-- Setup (`<process>.sup`, else `opxuac.sup`): `OPXC_DUR_QUEUE_SIZE` (10000 kB), heartbeats,
-  buffers, `OPXC_COM_STAT_CHK_INTERVAL` (10 s), `OPXC_STATION_CON_TRY_INTERVAL` (30 s; observed
-  retries every ~35 s), `OPXC_TIMESTAMP_OPTION` (SERVER/SOURCE), `OPXC_LOG_LEVEL`, service and
-  session time-outs, `OPXC_SERVICE_COMPLIANCE`. Log file `%TLS_LOG_PATH%\<PROCESS>.log`.
-- Quick load (§9.10–9.11): `OPCUAC_LINE_DF`, `…_STATION_DF`, `…_SUBSCRIPTION_DF`, `…_POINT_DF`
-  (+ alarm and method datasets). Dataset `OPCUAC_TAG_DF` browses a connected server
-  (filter on `OPC_STATION_NAME` and `OPC_TAG_PATH`).
+  `OPCUAC_PKI_CERTIFICATES_DF`; verified on R1.03 and R1.05); server certificates arrive in
+  `…\pkiclient\rejected` and must be trusted (Engineering Module, or move to
+  `…\pkiclient\trusted\certs`); folders `deleted`, `rejected` added by CI Server. The server
+  must trust the client's certificate too. Expiry warnings: see `IM36K10E20-01EN.md` §3.
+- Setup (§10.11; `<process>.sup`, else the template **`epauac_eqp.sup`** — the R1.03 edition
+  named `opxuac.sup`, which is not installed on R1.03 or R1.05, ISS-084): `OPXC_DUR_QUEUE_SIZE`
+  (10000 kB), heartbeats, buffers, `OPXC_COM_STAT_CHK_INTERVAL` (10 s),
+  `OPXC_STATION_CON_TRY_INTERVAL` (30 s; observed retries every ~35 s on R1.03),
+  `OPXC_TIMESTAMP_OPTION` (SERVER/SOURCE), `OPXC_LOG_LEVEL`, service and session time-outs,
+  `OPXC_SERVICE_COMPLIANCE`, and new in R1.04 `OPXC_BASE_MODEL_CHANGE_EVENT`,
+  `OPXC_ENABLE_EXTENDED_FUNC` (both NO). Log file `%TLS_LOG_PATH%\<PROCESS>.log`.
+- **Installed R1.05 `epauac_eqp.sup`** (verified 2026-10-08, ISS-083):
+  `OPXC_SERVICE_CALL_TIME_OUT = 60` (manual default 10 s); undocumented `OPXC_DISABLE_SAV_FILE`
+  (NO), `OPXC_ALARM_TIME_ATTRIBUTE` (tab *Alarm Time*), hidden `OPXC_CERT_EXP_PERIOD_WARN`
+  (2 months). `opxuac_mon.sup` is unchanged from R1.03 (none of the new keywords).
+- Quick load (§10.12–10.13): `OPCUAC_LINE_DF`, `…_STATION_DF`, `…_SUBSCRIPTION_DF`,
+  `…_POINT_DF` (+ alarm and method datasets). Dataset `OPCUAC_TAG_DF` browses a connected
+  server (filter on `OPC_STATION_NAME` and `OPC_TAG_PATH`; R1.05 adds `REBROWSE` and
+  `READ_NODE_INFO`). Line, station, subscription and point definitions are identical in R1.03
+  and R1.05 (verified).
 - Installed: `opxuac_mon` (a monitor instance) is started by `access_start.cmd`.
+- Upgrade from R1.03 (App. 1.3): set `OPXC_ENABLE_EXTENDED_FUNC` if A&C was used; methods
+  driven by dataset field updates no longer work — rebuild classes (`MTD_*`, extended reset),
+  symbols and displays, and re-save methods with String or Boolean input arguments. App. 1.4
+  (R1.05): one class name per method object.
 
-## 7. OPC UA server (§10)
+## 7. OPC UA server (§11)
 
+- Since R1.04 the server offers only Data Access and methods by default. **Alarms &
+  Conditions, HistoryRead and PubSub need `OPXUAS_ENABLE_EXTENDED_FUNC = YES`** in `opxuas.sup`
+  (ch. 11 intro, §11.6.2; installed default NO, verified on R1.05). An upgrade with the
+  automatic configuration merge sets it; otherwise set it by hand if these were used
+  (App. 1.3).
 - Process `OPXUAS` (`opxuas -n opxuas`, started by `access_start.cmd`; stop `durstp -m -p
   opxuas`), Unified Automation C++ SDK, port **34493**. Log `%TLS_ALLUSERS_PATH%\log\OPXUAS.log`
   and `OpxUas_Sdk*.log`.
-- Visible data: sections, objects, items with *OPC visible*; items also need **Read** (read
-  values, browse into the item) and **Write** (write values, alarm methods). Parent sections must
-  be visible. Without Read the item is listed but browsing into it fails
-  (`UncertainNotAllNodesAvailable`).
-- Users: anonymous = like `OPC_UA_SERVER_READ`; authorisation actions `OPC_UA_SERVER_READ`
-  (browse, read, history) and `OPC_UA_SERVER_MODIFY` (+ write, methods).
-- Address space: `Objects` → sections (folders) → objects → items (`CIItemNumericType`,
-  `…BooleanType`, `…StringType`, `…NumericSubType`) with child nodes such as `Value`,
-  `Status`, `Blocked`, `Offline`, `HMIInfo`, and alarm condition nodes. Types are in
-  `http://www.yokogawa.com/CI_Server/` (ns 3 in the manual). **CI Server entities (sections,
-  items) are in namespace `urn:Yokogawa:CI_SERVER_OPC_UA_SERVER`** (verified by browsing;
-  the manual does not name it, ISS-032).
+- Visible data (§11.1.4): sections, objects, items with *OPC visible*; items also need **Read**
+  (read values, browse into the item) and **Write** (write values, alarm methods). Parent
+  sections must be visible. Without Read the item is listed but browsing into it fails
+  (`UncertainNotAllNodesAvailable`). External alarms: OPC visible / read / write / manual reset
+  in the station's alarm template settings.
+- Users (§11.1.5–11.1.6): anonymous = like `OPC_UA_SERVER_READ`; authorisation actions
+  `OPC_UA_SERVER_READ` (browse, read, history) and `OPC_UA_SERVER_MODIFY` (+ write, methods).
+  Anonymous access is governed by the `dssana.sup` user interface "Anonymous Via OPC UA
+  Server" (`OPXUASANY`): installed default (R1.03 and R1.05) is no login with profile
+  `CI_NO_LOGIN_OPCUAS` for local clients and *Manual CI Server* for remote clients. With AD
+  integration, "Via OPC UA Server" + *Automatic* needs no AD password.
+- Address space (§11.3, now called the **native information model**): `Objects` → sections
+  (folders) → objects → items (`CIItemNumericType`, `…BooleanType`, `…StringType`,
+  `…NumericSubType`) with child nodes such as `Value`, `Status`, `Blocked`, `Offline`, `HMIInfo`,
+  and alarm condition nodes. Types are in `http://www.yokogawa.com/CI_Server/` (ns 3 in the
+  manual). **CI Server entities (sections, items) are in namespace
+  `urn:Yokogawa:CI_SERVER_OPC_UA_SERVER`** (verified by browsing on R1.03; the manual does not
+  name it, ISS-032).
 - NodeIds are JSON strings: `{"nsid":"<namespace id>"}` for the entity,
   `{"0":"Value","nsid":"<n>"}` for its value; or by name: `{"0":"Value","itnm":"<item>"}`
-  (case sensitive; verified). The `nsid` changes when the item is recreated — prefer `itnm`.
-  `OPXUAS_USE_NAME_NODEIDS` makes the server use names in its own IDs.
+  (case sensitive; verified on R1.03). The `nsid` changes when the item is recreated — prefer
+  `itnm`. `OPXUAS_USE_NAME_NODEIDS` makes the server use names in its own IDs.
 - Status mapping: NORMAL → Good; NOT_INIT, UPD_OFF, OFFSCAN, OFFLINE, UNREACH →
   BadNoCommunication; BAD_VALUE → Bad. Types: Boolean, Int32, Double, String. Priority →
-  severity: 1 → 1000, 2 → 900 … 15 → 50, 0 → 1 (changed in R1.03).
-- History: items in a history group show HistoryRead; max 5000 values per node per call.
-- Alarm methods: Acknowledge, Confirm (= acknowledge), Disable/Enable (force to normal);
-  external alarms Acknowledge/Confirm passed to the source; `CIManualReset` for CENTUM.
-- `opxuas.sup`: General (`FTFW_*` queue, heartbeat, log), OPC UA Server tab
+  severity: 1 → 1000, 2 → 900 … 15 → 50, 0 → 1 (since R1.03).
+- History (§11.3.3; extended functions): items in a history group show HistoryRead; max 5000
+  values per node per call.
+- Alarm methods (extended functions): Acknowledge, Confirm (= acknowledge), Disable/Enable
+  (force to normal); external alarms Acknowledge/Confirm passed to the source;
+  `CIManualReset` for CENTUM.
+- **Imported information model (§11.4, new in R1.05)**: a standard NodeSet file (UANodeSet 1.05
+  schema) is mapped to CI Server entities with the OPC UA Information Model Mapper
+  (`IM36K10E20-01EN.md` §4) and loaded as `%TLS_DAT_PATH%\<queue>_<NodeSet file>.xml` (one per
+  server process, reloaded at server start). Mapping: section/object → Object; method object
+  (`MTD_*` class; sample `UAS_MTD_JBASE`) → Method; item/sub-item → Variable; item alarm or
+  external alarm → Event. OPC visible / Read / Write still apply. Once loaded, the native model
+  is hidden unless `OPXUAS_ENABLE_OWN_MODEL_TREE` (manual name `…_NATIVE_MODEL_TREE`) is YES.
+  Variables: no arrays, basic types only; out-of-range values give `BadOutOfRange` (item
+  status unchanged). Method calls return OPC UA status codes (e.g. `BadUserAccessDenied`,
+  `BadNotExecutable` when the item is blocked or the object not OPC visible). Rights:
+  `UA_MAPPER_PROJECT_INSERT` / `_MODIFY` / `_DELETE` (in `SYSTEM_MANAGER`), dataset
+  `UASERVER_MAPPER_DF`.
+- `opxuas.sup` (§11.6): General (`FTFW_*` queue, heartbeat, log), OPC UA Server tab
   (`OPXUAS_OPTIONAL_NODES`, `…_MODEL_CHANGE_EVENTS`, `…_USE_NAME_NODEIDS`,
   `…_USE_DYNAMIC_SCANRATE`, `…_SOURCE_TIME_STAMPS`, `…_USE_RAW_STATUS`,
-  `…_VARIABLE_CACHE_SIZE` 100000, `…_NUM_VALUES_PER_NODE` 5000), Alarm settings (`EVENTS` =
-  ALARM, ACKN, DEACT, INFO), Logging. Installed keyword names: `OPXUAS_DYNAMIC_SCANRATE`
-  (manual `…_USE_DYNAMIC_SCANRATE`) and extra `OPXUAS_SET_HIGH_PRIO_15` (ISS-034).
-- `%TLS_ROOT_PATH%\tls\exe\ServerConfig.xml`: endpoint `opc.tcp://[NodeName]:34493`; trust list
-  `…\pki\opxuas\pkiserver\trusted\certs`, rejected `…\pkiserver\rejected` (created at the first
-  rejection), own certificate `ciserveruaserver.der`. **Installed**: only Basic256Sha256,
+  `…_VARIABLE_CACHE_SIZE` 100000, `…_NUM_VALUES_PER_NODE` 5000, and new
+  `…_ENABLE_NATIVE_MODEL_TREE`, `…_ENABLE_EXTENDED_FUNC`), Alarm settings (`EVENTS` = ALARM,
+  ACKN, DEACT, INFO), Logging. `OPXUAS_MODEL_CHANGE_EVENTS` now needs the extended functions;
+  it sends BaseModelChangeEvents (also on NodeSet load/unload) and GeneralModelChangeEvents for
+  root-level entities — deeper levels need an item `NodeVersion` (or `<process>_NodeVersion`,
+  OPC visible + Read) at that level.
+- **Installed keyword names differ** (verified R1.03 and R1.05): `OPXUAS_DYNAMIC_SCANRATE`
+  (manual `…_USE_DYNAMIC_SCANRATE`), extra `OPXUAS_SET_HIGH_PRIO_15` (ISS-034); R1.05:
+  `OPXUAS_ENABLE_OWN_MODEL_TREE` (manual `…_NATIVE_MODEL_TREE`) and hidden
+  `OPXUAS_METHOD_TIMEOUT_MARGIN` (10000 ms) (ISS-082).
+- `ServerConfig.xml` (§11.7): the manual still gives `%TLS_ROOT_PATH%\tls\exe`; **installed
+  R1.05 has it only in `%TLS_SAV_PATH%`** (R1.03: `tls\exe`; ISS-081). Endpoint
+  `opc.tcp://[NodeName]:34493`; trust list `…\pki\opxuas\pkiserver\trusted\certs`, rejected
+  `…\pkiserver\rejected` (created at the first rejection), own certificate
+  `ciserveruaserver.der`. **Installed (R1.03 and R1.05)**: only Basic256Sha256,
   Aes128_Sha256_RsaOaep, Aes256_Sha256_RsaPss with Sign / SignAndEncrypt (no None endpoint);
   anonymous, user/password **and certificate** user tokens enabled (manual: certificate off,
-  ISS-034); `AutomaticallyTrustAllClientCertificates` false.
-- First connection of any client: trust the server certificate on the client, then move the
-  client certificate from the server's `rejected` to `trusted\certs`. UaExpert is the
+  ISS-034); `AutomaticallyTrustAllClientCertificates` false. The R1.05 file adds SDK sections
+  (role configuration, user/password management, PubSub settings).
+- First connection of any client (§11.1.6): trust the server certificate on the client, then
+  move the client certificate from the server's `rejected` to `trusted\certs`. UaExpert is the
   suggested test client.
-- Discovery: LDS on 4840 only when several servers are on a host; GDS for central certificate
-  management (concepts only).
+- Extra server instances (for PubSub lines or to test an information model): copy
+  `ServerConfig.xml` to `<instance>_ServerConfig.xml` with another port, copy `opxuas.sup` to
+  `<instance>.sup`, add a start line in `access_start.cmd`; instance names start with `OPX`
+  (IM 36K10E20 4th ed. §3.4).
+- Discovery (§11.8): LDS on 4840 only when several servers are on a host; GDS for central
+  certificate management (concepts only).
 
 ## 8. RDBMS data exposure (not in this manual)
 
 IM 36K10L45 does not describe RDBMS data exposure; it is in the Tutorial (IM 36K10G10 ch. 10)
 and the item form (IM 36K10C10 §3.3). Summary here because it is an ACCESS-type interface;
-**tested in R1.05 only** (user system, 2026-10-02; R1.03 files checked read-only and identical).
-Procedure: skill `data-access`, task `rdbms-exposure.md`.
+**tested in R1.05 only** (user system, 2026-10-02; R1.03 files checked read-only and identical;
+R1.05 files re-checked 2026-10-08). Procedure: skill `data-access`, task `rdbms-exposure.md`.
 
 - Processes `DBCSND` (sender, subscribes to DSS data) and `DBCDEM` (receiver, writes to MS SQL
   Server via ODBC); setup file `dbc.sup` (sender and receiver tabs; connection string
@@ -201,3 +279,29 @@ Procedure: skill `data-access`, task `rdbms-exposure.md`.
   log disagree (ISS-058).
 - The CI Service account `.\CIX_PROCESS` is local, so a remote SQL Server needs a SQL login and
   mixed mode (ISS-059).
+
+## 9. RESTful API (§4, new in R1.04)
+
+From docs; port 34597 listening and the `jrstsrv.sup` keywords verified on R1.05 (2026-10-08).
+No request was sent.
+
+- HTTPS server installed with CI Server and started/stopped by ACCESS Service, on a CI Core or
+  on a CI Portal (reaching the core over MDUR). Not supported by CI View, Remote Connect or
+  enterprise setups. Nothing to install on the client.
+- Authentication: HTTP Basic (CI Server user) plus an API key sent in the `x-api-key` header.
+  Keys are made in the Engineering Module (*Authorisation › Users*, *Add API Key*, type RESTful
+  API), one per user; stored in dataset `API_KEYS_DF`.
+- `jrstsrv.sup` (§4.2.1): `JRST_MAX_RECORDS` (records per reply, default 100),
+  `JRST_USE_TWO_WAY_SSL` (default off: client trusts the server's self-signed certificate in
+  `%TLS_ALLUSERS_PATH%\pki\jrstsrv\keystore`), `JRST_READ_ONLY_MODE` (default on),
+  `JRST_NETWORK_PORT` (34597), `JRST_USER_CACHE_TIME` (600 s, must be > 0),
+  `JRST_CUSTOM_DATASETS` (user datasets with read/write rights).
+- Requests (§4.3.2): `https://<host>:34597/jrest/v2/<entity type>/<function>` with OData
+  options `$filter`, `$select`, `$top`, `$skip`; replies are OData JSON. Entity sets `Tags`,
+  `EventCategories`, `EventRecords`. Functions: `GetHistory` (one tag, ISO 8601 times, sample
+  interval in s; highest-priority history group), `GetHistoryMultiTag` (≤ 5 tags),
+  `GetEventHistory`, `GetAuditInfo`, `GetCurrentAlarms`, `AcknowledgeAlarms` (several per
+  request), `UpdateItems` (value, optional quality and status — status must match
+  `STATUS_DF.NAME`), `ReadDataset` and `Dataset` (PUT/PATCH/DELETE on custom datasets).
+- Status codes (§4.3.3): 200, 204, 400 (bad URL or no data), 401 (rights or credentials), 404,
+  405, 500, 503.
diff --git a/knowledge/progress.md b/knowledge/progress.md
index 36683ba..2b077aa 100644
--- a/knowledge/progress.md
+++ b/knowledge/progress.md
@@ -40,25 +40,31 @@ and its row here is updated.
 
 **R1.05 status:** not started · manual diff read · re-checked (read-only) · re-tested · done
 
+Two labels for checks Claude cannot do (details and steps in
+[`r105-verification.md`](r105-verification.md)): **not tested** = the function is not
+available on the R1.05 test server (reason given); **awaiting user verification** = Claude
+prepared the step and the user runs it on the server or in the GUI and sends the output or a
+screenshot.
+
 | Skill / area | Manual changes after R1.03 | R1.05 status | Notes |
 |---|---|---|---|
 | `system-check` | — | re-checked (read-only) | Version, paths, service, node, time on the R1.05 test server 2026-10-08. Start/stop not repeated (shared server). |
-| `installation-security` | C10, C30 (large: IT security 3.0, LAPS, upgrade merge `jupgutl`, PRM) | manual diff read | |
-| `data-access` | L45, E20 (large: OPC UA methods, information model mapper, certificate expiry), L50 dataset rename | manual diff read | |
-| `equipment` | L41 (IEC 61850, item status, App. 1); IEC 104/61850 drivers moved to `eqt`/`eta` | manual diff read | |
+| `installation-security` | C10, C30 (large: IT security 3.0, LAPS, upgrade merge `jupgutl`, PRM) | re-checked (read-only) | 2026-10-08: skill, summaries and `tools/setup_check.ps1` updated to R1.05. Setup check run by hand on the R1.05 test server. Script run there too (12 OK, 5 CHECK, 20 DIFF; firewall check fixed). **Not tested:** IT security 2.0/3.0, LAPS, Vnet/IP, upgrade merge, PRM (not available there). ISS-086–090. |
+| `data-access` | L45, E20 (large: REST API, OPC UA methods, information model mapper, certificate expiry, extended functions off by default), L50 dataset rename | re-checked (read-only) | 2026-10-08: skill and summaries updated, L45 section numbers remapped. Setup files, datasets, ports and certificates checked; Sample qli files unchanged. New form fields confirmed in the installed form definitions (V3); OPC UA loopback re-tested on R1.05 with the reduced sample load (V4, 2026-10-08), certificate exchange done by the user. **Not tested:** OPC A&E direct alarms, PubSub, imported information model. ISS-080–085. |
+| `equipment` | L41 (IEC 61850, item status, App. 1); IEC 104/61850 drivers moved to `eqt`/`eta` | re-checked (read-only) | 2026-10-08: Modbus datasets, setup files and tools identical to R1.03; EQT family, IEC 61850 report control blocks and upgrade steps added. Sample qli files unchanged. `eqpdbg` main info run on R1.05 (V1); Modbus loopback re-tested on R1.05 with the reduced sample load (V4, 2026-10-08). **Not tested:** IEC 104 / IEC 61850 and the EQT tools (no device). ISS-076–079. |
 | pyTOOLS (new) | P40 new | not started | No skill yet. |
 | `graphics` | C50, C60, R30 (small) | manual diff read | |
-| `history-management` | C40 §4.2 (REST API, pyTOOLS) | manual diff read | |
+| `history-management` | C40 §4.2 (REST API, pyTOOLS) | manual diff read | The REST API itself is described in skill `data-access` (L45 ch. 4); link to it from here. |
 | `portal-setup` | R10 §3.3 | manual diff read | |
 | `system-management` | J10 §2.9.1, L50 | manual diff read | |
 | `item-engineering` | C10 §2.2 | manual diff read | |
 | `alarm-management` | none | not started | |
 | `audit-trail` | none | not started | |
 | `authorization` | none (new `dss_ath_grp_u0104` loader) | not started | |
-| `class-object-engineering` | none | not started | |
+| `class-object-engineering` | none | not started | Sample classes `CIENG_INCR`, `CIENG_TANK` (traditional) and `CIENG_JFLOW` (Java) loaded and ran correctly on R1.05 (V4, 2026-10-08). |
 | `high-availability` | none | not started | |
 | `reporting` | none | not started | |
-| `examples/CI-Eng-Sample` | — | not started | Load on the shared server only with the user's approval. |
+| `examples/CI-Eng-Sample` | — | re-tested | Reduced load (no history group, user or layouts) loaded, tested and removed on the shared R1.05 server 2026-10-08 (V4); scripts in `shared\`. Full load not tested on R1.05. |
 
 ## Manuals, in working order
 
diff --git a/knowledge/r105-verification.md b/knowledge/r105-verification.md
new file mode 100644
index 0000000..fd77f85
--- /dev/null
+++ b/knowledge/r105-verification.md
@@ -0,0 +1,102 @@
+# R1.05 verification checklist
+
+Two kinds of R1.05 checks are open after the read-only re-check of 2026-10-08:
+
+- **Not tested:** the function is not available on the R1.05 test server, so it cannot be
+  tested there at all. The content stays "from docs" and is marked **not tested** with the
+  reason. Nothing to do until a suitable system exists.
+- **Awaiting user verification:** Claude could not run the step itself (refused as a remote
+  command, needs an administrator, needs the GUI). Claude prepared the steps and expected
+  results below; the user runs them on the server or in the GUI and sends the output or a
+  screenshot, and Claude records the result in the task file and in `progress.md`.
+
+All steps below are read-only: they open forms or print information and save nothing.
+Close every form with *Cancel*.
+
+## Not tested on the R1.05 test server
+
+| Area | Reason | Where marked |
+|---|---|---|
+| IT Security Tool (version 2.0 / 3.0), `CIX_` groups, `CTM_PROCESS`, LAPS, GPO import | Tool not installed; Windows Server 2025 is not supported by the tool | skill `installation-security`, C10/C30 summaries |
+| Vnet/IP drivers, VAGW Bossd | No Vnet/IP card; not supported on Server 2025 | skill `installation-security`, C10 summary |
+| Upgrade from R1.03/R1.04 with the automatic configuration merge (`jupgutl`, `-c` argument) | Fresh R1.05 install, no upgrade to observe; an upgrade test needs a separate machine | C10 summary, ISS-086 |
+| CI Server with PRM | No PRM | C10 summary, ISS-090 |
+| IEC 60870-5-104 and IEC 61850 (EQT managers, report control blocks, `eqtdbg`, `eqtfrcscn`) | No device and no EQT line on the server | skill `equipment`, L40/L41 summaries, ISS-076–079 |
+| OPC A&E `OPXAES_DIR_ALM`, OPC UA PubSub, imported information model | Needs another client/server or extra server instances | skill `data-access`, ISS-085 |
+
+## Awaiting user verification
+
+### V1. `eqpdbg` main info (skill `equipment`, L40 summary §3): **done 2026-10-08**
+
+Run by Claude over ssh at the user's request; output as expected (recorded in the L40 summary).
+
+On the R1.05 test server, in a normal command prompt:
+
+```
+eqpdbg 0 EQPMDC
+```
+
+Type `1` (Get main info), Enter, read the output, then `-1` (Exit). Expected: line type 107,
+the Modbus line(s) attached, scan interval (tick) in ms, number of slaves, line load %.
+Do not choose any other action number. Send a screenshot of the output.
+
+### V2. Setup check script (skill `installation-security`, task `setup-check.md`): **done 2026-10-08**
+
+Run by Claude (temporary copy, deleted afterwards): 12 OK, 5 CHECK, 20 DIFF after fixing the
+firewall check (see `setup-check.md`).
+
+Copy `tools/setup_check.ps1` from this repo to a scratch folder on the server, run it in an
+**elevated** Windows PowerShell, then delete the copy:
+
+```
+powershell -NoProfile -ExecutionPolicy Bypass -File setup_check.ps1
+```
+
+Expected (from the one-by-one checks of 2026-10-08): CI Server 1.05.00 OK; Windows Server 2025
+Datacenter shown as not in the list; DIFF for firewall domain profile, Defender, automatic
+updates, defrag / component cleanup, page file, .NET 3.5, missing `CIX_` groups; CHECK lines
+for IT security. Send the result table (screenshot or text).
+
+### V3. Engineering Module forms (skill `data-access`): **form definitions checked 2026-10-08**
+
+Claude has no GUI access to the server. Checked instead in the installed form definitions
+(`tls\wap\cfg`): the main menu has the *OPC UA Information Model Mapper* action (dataset
+`UASERVER_MAPPER_DF`); each user in the project tree has *Add API key* (dataset `API_KEYS_DF`);
+the OPC UA client point form has `READ_NODE_INFO` and `REBROWSE`; the method form has node ID
+type, parent object node ID, manual argument fields and no process-area field. Screenshots of
+the open forms are optional.
+
+In the Engineering Module on the server (log on as a user with engineering rights), open each
+form below, take a screenshot, and close it with *Cancel*:
+
+1. *Tools › OPC UA Information Model Mapper*: the mapper window opens (shows *New Mapping*).
+2. *Authorisation › Users*, any user: the *Add API Key* function exists (do not create a key).
+3. An OPC UA client point form (*New* on an OPC UA station is enough to see it, then
+   *Cancel*): the checkbox *Read additional node information* exists.
+4. An OPC UA client method form: fields for node ID type, *Options* tab (parent object node ID)
+   and *Arguments* tab; no process-area field.
+
+If no OPC UA client line exists on the server, steps 3–4 need one: skip them and say so.
+
+### V4. CI-Eng-Sample on the R1.05 test server: **reduced load tested 2026-10-08**
+
+The user approved a reduced load (no history group, no user `CIENG`, no layouts/displays) that
+is removed again afterwards. Scripts: `examples/CI-Eng-Sample/shared/`.
+
+- Load: 0 errors in every step; R1.05 accepts the sample's `@VERSION 1.03.00` files.
+- Classes: `DEMO.COUNTER` counts (65 → 68 in 3 s); `TANK1.CALC.VOLUME` = 100 for level 50
+  (traditional class); `TANK1.JFLOW.sPerMin` = 2 for inflow 120 (Java class); sub-item
+  `TANK1.LEVEL.MAX` follows the level.
+- Modbus loopback (mirror started for the test only): setpoint 1234 → readback 1234,
+  `PLC1.COMM_OK` = 1; `eqpdbg 0 EQPCIENG` slave info: `CIENG_PLC` ON_SCAN, line GOOD.
+- OPC UA loopback: after the two certificate moves done by the user, `UA.COMM_OK` = 1 (status
+  5), `UA.SRV_STATE` = 0, `UA.LEVEL_COPY` followed `TANK1.LEVEL` (62.5). While the server still
+  rejected the client, the Boolean status item showed 0 with status 4 (ISS-080).
+- Remove: 0 errors. Before/after snapshot: all datasets identical (count and name hash), no
+  `CIENG*` record left. Left over and cleaned: 34 `dss_*.tmp` files in `tls\lst` (ISS-091),
+  `OPXCIENG.log`, the temporary sample copy.
+- Certificates: the test's files (client own certificate `<host>_OPXCIENG.der/.pem`, the
+  server certificate trusted in the client store, the client certificate trusted in the
+  server store) and the `pkiserver\rejected` folder created by the test were deleted with the
+  user's approval. `OPCUAC_PKI_CERTIFICATES_DF` went back from 3 to 1 record by itself: the
+  dataset follows the certificate files. The server is back in its original state.
diff --git a/knowledge/version-differences.md b/knowledge/version-differences.md
index aa3ae45..316fcb6 100644
--- a/knowledge/version-differences.md
+++ b/knowledge/version-differences.md
@@ -31,7 +31,7 @@ until they are re-checked.
 | IEC 60870-5-104 and IEC 61850 drivers | New driver family `eqt*` / `eta*`: `eqt104`, `eqt850`, `eqt850dmp`, `eqtdbg`, `eqtfrcscn`, `eqtiostat`, `etaman`, `eta104*.sup`, `eta850*.sup`, `eqtini.sup`, `eqt850.icd`, `eqtfrcscn.tpl`, `eqtini.tpl` | `eqp104`, `eqp850`, `eqp850dmp`, `epa104*.sup`, `epa850*.sup` (the drivers left the `eqp` EQUIPMENT family) |
 | IEC 61850 configuration | Quick load / form programs `iec61850_line_u0104`, `iec61850_station_u0104`, `iec61850_point_u0105`, `iec61850_rcb_u0105` | — |
 | OPC UA | `opcuac_method_u0104` (OPC UA client methods), `opcuac_station_u0104`, `opcaec_station_u0104` | `opcaec_station_u0103` |
-| REST API | `jrstsrv.jar`, `jrstsrv.sup`, `jrstsrv.tpl` (RESTful API server, see IM 36K10C40 §4.2) | — |
+| REST API | `jrstsrv.jar`, `jrstsrv.sup`, `jrstsrv.tpl` (RESTful API server on TCP 34597, IM 36K10L45 ch. 4; skill `data-access`) | — |
 | Upgrade | `jupgutl.cmd`, `jmrg.jar` (merge configuration files on upgrade, IM 36K01C10 ch. 3) | — |
 | Data access | `dacbackfill.cmd`, `intimpdac.exe` (OPC DA backfill; not yet investigated) | — |
 | Graphics | `connectrdp.cmd` (Edit Module *RDP Connect* action, IM 36K10C50 §2.31) | — |
@@ -56,7 +56,7 @@ the R1.04 and R1.05 revision tables.
 | IM 36K10L45 Data Access Engineering | R1.04: ch. 4 new, §10.3.4, 10.5, 10.6 new, setup-file parameters in §10.4, 10.9, 11, 11.5.2. R1.05: §11.4 new, §11.1.6 note, §11.6.2 setup file, App. 1.3 | `data-access` |
 | IM 36K10E20 OPC Interface | R1.04: parent object node ID and arguments of OPC UA methods. R1.05: certificate-expiry notifications, ch. 3 new *OPC UA Information Model Mapper* (map external OPC UA entities to CI Server), App. 1 SQL keywords | `data-access` |
 | IM 36K10L41 EQUIPMENT Configuration | R1.04: item status descriptions (§3.4.5–3.4.8), §3.12.2, §3.15, IEC 61850 functions (§3.32), App. 1 new (precautions on upgrade to R1.04). R1.05: §3.32, App. 1.3, App. 1.4 new | `equipment` |
-| IM 36K10L50 Data Set Service Engineering | R1.04: OPC UA client method dataset renamed `OPCUAC_METHOD_CALL_IN_DF` → `OPCUAC_METHOD_CALL2_DF` | `system-management`, `data-access` |
+| IM 36K10L50 Data Set Service Engineering | R1.04: OPC UA client method dataset renamed `OPCUAC_METHOD_CALL_IN_DF` → `OPCUAC_METHOD_CALL2_DF` (installed: `…CALL_IN_DF` and `…CALL_OUT_DF` both gone); new datasets `IEC61850_RCB_DF`, `UASERVER_MAPPER_DF`, `API_KEYS_DF` | `system-management`, `data-access` |
 | IM 36K10C40 Engineering Module – Historical | R1.04 §4.2: external access to history now lists ODBC, .NET API, **RESTful API**, **pyTOOLS** (C API no longer listed) | `history-management` |
 | IM 36K10C50 Edit Module | R1.04: §2.22 properties, §2.31 *Password Check* action, §4.12 update item/parameter. R1.05: §2.22, 2.25, 2.26, 2.33 properties, §2.31 *RDP Connect* action | `graphics` |
 | IM 36K10C60 Advanced Operating Graphics | R1.04 §1.2.2: demo displays | `graphics` |
@@ -67,17 +67,36 @@ the R1.04 and R1.05 revision tables.
 | IM 36K10G10 Tutorial | R1.04 §9.2, ch. 14 new. R1.05 ch. 14 extended, ch. 15 new | `knowledge/manuals/IM36K10G10-01EN.md` |
 | IM 36K10L55 Exchange Tool Engineering | R1.04: upgrade scenario for CI Exchange for CENTUM VP. R1.05 §2.7: HIS-TSE connection options | `knowledge/manuals/IM36K10L55-01EN.md` |
 
-**No content change** (only contact information or wording): C20, C30, E10, E30, J20, J40,
-L10, L15, L20, L25, L30, L35, L36, L40, P10, P11, P20, P30, R20, R40. Skills based only on
-these manuals still need a quick re-test on R1.05 (installed files may differ), but their
-content is expected to hold.
+**Revision table lists only contact information:** C20, C30, E10, E30, J20, J40, L10, L15,
+L20, L25, L30, L35, L36, L40, P10, P11, P20, P30, R20, R40. The revision tables do not list
+every R1.04 edit, so each of these was also compared word by word with its R1.03 edition
+(`tools/manual_diff.py`, 2026-10-08). Result:
+
+| Manual | Unlisted changes found by the text diff |
+|---|---|
+| E10 Excel Add-in | Item search: new description of the *Item Filter* / *Description Filter* boxes and wildcards (`*` default; both filters combine with AND); a CI Portal SSL note moved |
+| E30 Alarm System Performance Analysis | KPI grid: the KPI charts now have labels (*In Time*, *Too Late*, *Not Ackn*, *Nuisance*) |
+| L30 BUS Service | `durwfp` return value reworded (1 = process attached/running, 0 = otherwise); same meaning |
+| P11 Java class language | §10.2 methods reworded; same meaning |
+| P20 RQL | Footer `<position>` sentence split in two; same meaning |
+| L40, R20, R40, C30, L35, J40 | Spacing, punctuation, titles only |
+| C20, J20, L10, L15, L20, L25, L36, P10, P30 | None |
+
+Skills based only on these manuals still need a quick re-test on R1.05 (installed files may
+differ), but their content is expected to hold. The E10 and E30 changes go into the
+`reporting` and `alarm-management` re-checks.
+
+**Method for every manual re-check:** do not rely on the revision table or the release notes.
+Run `python tools/manual_diff.py <R1.03 doc\EN> <R1.05 doc\EN> <IM>` and review every change,
+including those made in R1.04.
 
 ## 3. Re-check plan
 
 Order (biggest change first), tracked in `progress.md` under *R1.05 re-check*:
 
 1. `system-check` (paths, version string): done in the baseline.
-2. `installation-security`, `data-access`, `equipment`: real manual changes.
+2. `installation-security`, `data-access`, `equipment`: real manual changes. Re-checked read-only 2026-10-08
+   (ISS-076–090). IM 36K10L45 section numbers moved by one chapter from ch. 4 on (new ch. 4 REST API).
 3. New pyTOOLS manual (P40) and the REST API.
 4. `graphics`, `history-management`, `portal-setup`, `system-management`.
 5. All other skills: re-test the task files on R1.05, no manual change expected.
diff --git a/tools/manual_diff.py b/tools/manual_diff.py
new file mode 100644
index 0000000..be440d4
--- /dev/null
+++ b/tools/manual_diff.py
@@ -0,0 +1,71 @@
+"""Word-level diff of one CI Server manual between two releases (e.g. R1.03 and R1.05).
+
+Catches changes the revision table does not mention (for example R1.04 edits listed only as
+"Added contact information"). Needs `pdftotext` (Poppler / Git for Windows) on PATH.
+
+Usage:
+    python tools/manual_diff.py <old_pdf_dir> <new_pdf_dir> IM36K10L40-01EN [more IMs] [-o out_dir]
+
+Prints one block per change: [replace]/[insert]/[delete] with old (-) and new (+) words.
+Page footers, edition lines and dates are removed first, so only text changes remain.
+Writes nothing into the repo; with -o it saves <IM>.diff.txt files in out_dir.
+"""
+import difflib
+import os
+import re
+import subprocess
+import sys
+import tempfile
+
+NOISE = re.compile(
+    r'IM ?36K\w+-01EN( \d+\w\w Edition)?( : [A-Za-z]+\.? ?\d+, ?\d+-00)?'
+    r'|\d+(st|nd|rd|th) Edition|Toc-\d+|Rev-\d+|App\.\d+-\d+|\b\d+-\d+\b')
+
+
+def words(pdf):
+    with tempfile.TemporaryDirectory() as d:
+        out = os.path.join(d, 'm.txt')
+        subprocess.run(['pdftotext', pdf, out], check=True)
+        text = open(out, encoding='utf-8', errors='replace').read()
+    return NOISE.sub(' ', text).split()
+
+
+def diff(old_pdf, new_pdf):
+    a, b = words(old_pdf), words(new_pdf)
+    sm = difflib.SequenceMatcher(None, a, b, autojunk=False)
+    lines = []
+    for op, a1, a2, b1, b2 in sm.get_opcodes():
+        if op == 'equal':
+            continue
+        lines.append('[%s] at word %d\n  - %s\n  + %s' % (
+            op, a1, ' '.join(a[a1:a2]), ' '.join(b[b1:b2])))
+    return lines
+
+
+def main(argv):
+    out_dir = None
+    if '-o' in argv:
+        i = argv.index('-o')
+        out_dir = argv[i + 1]
+        del argv[i:i + 2]
+    if len(argv) < 3:
+        sys.exit(__doc__)
+    old_dir, new_dir, ims = argv[0], argv[1], argv[2:]
+    for im in ims:
+        old_pdf = os.path.join(old_dir, im + '.pdf')
+        new_pdf = os.path.join(new_dir, im + '.pdf')
+        if not os.path.exists(old_pdf):
+            print('=====', im, ': new manual (no old edition)')
+            continue
+        lines = diff(old_pdf, new_pdf)
+        report = '\n'.join(lines)
+        print('=====', im, ':', len(lines), 'changes')
+        if out_dir:
+            os.makedirs(out_dir, exist_ok=True)
+            open(os.path.join(out_dir, im + '.diff.txt'), 'w', encoding='utf-8').write(report)
+        else:
+            print(report)
+
+
+if __name__ == '__main__':
+    main(sys.argv[1:])
diff --git a/tools/setup_check.ps1 b/tools/setup_check.ps1
index 8af3c53..ac45082 100644
--- a/tools/setup_check.ps1
+++ b/tools/setup_check.ps1
@@ -1,8 +1,15 @@
-# CI Server R1.03 - read-only setup check
-# Compares a machine with the Windows settings required by CI Server Setup (IM 36K01C10-01EN §2.1.2)
-# and the IT security state described in the Security Guide (IM 36K01C30-01EN §2.2, §3.2).
+# CI Server R1.05 / R1.03 - read-only setup check
+# Compares a machine with the Windows settings required by CI Server Setup (IM 36K01C10-01EN §1.3.2, §2.1.2)
+# and the IT security state described in the Security Guide (IM 36K01C30-01EN §2.2, §3.2, §3.5.4).
+# R1.05 rules: 5th editions (Feb. 2026); R1.03 rules: 3rd editions (Sep. 2023).
 # Changes nothing. Run in Windows PowerShell 5.1; some checks need an elevated session.
-# Usage: powershell -NoProfile -ExecutionPolicy Bypass -File tools\setup_check.ps1
+# Usage: powershell -NoProfile -ExecutionPolicy Bypass -File tools\setup_check.ps1 [-Version 1.05.00|1.03.00]
+param(
+    [ValidateSet('1.05.00', '1.03.00')]
+    [string]$Version = '1.05.00'
+)
+$isR103 = ($Version -eq '1.03.00')
+"Target: CI Server R$Version"
 
 $results = New-Object System.Collections.Generic.List[object]
 function Add-Result($area, $check, $expected, $actual, $ok) {
@@ -19,8 +26,8 @@ $ci = $null
 foreach ($k in 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*', 'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*') {
     foreach ($i in (Get-ItemProperty $k -ErrorAction SilentlyContinue)) { if ($i.DisplayName -like 'CI Server R*') { $ci = $i } }
 }
-if ($ci) { Add-Result 'CI Server' 'Installed version' '1.03.00' $ci.DisplayVersion ($ci.DisplayVersion -eq '1.03.00') }
-else { Add-Result 'CI Server' 'Installed version' '1.03.00' 'not found' $false }
+if ($ci) { Add-Result 'CI Server' 'Installed version' $Version $ci.DisplayVersion ($ci.DisplayVersion -eq $Version) }
+else { Add-Result 'CI Server' 'Installed version' $Version 'not found' $false }
 $svc = Get-Service StartCIServer -ErrorAction SilentlyContinue
 if ($svc) {
     Add-Result 'CI Server' 'CI Service state' 'Running (when in use)' $svc.Status $null
@@ -33,10 +40,27 @@ Add-Result 'CI Server' 'VAGW Bossd service' 'present only if installed with IT S
 
 # --- Operating system --------------------------------------------------------
 $os = Get-CimInstance Win32_OperatingSystem
-$supported = @('Windows 10 Pro', 'Windows 10 Enterprise', 'Windows 10 IoT Enterprise', 'Windows Server 2016', 'Windows Server 2019', 'Windows Server IoT 2019')
-$osOk = $false; foreach ($s in $supported) { if ($os.Caption -like "*$s*") { $osOk = $true } }
-Add-Result 'Windows' 'Operating system' 'Win10 Pro/Enterprise/IoT LTSB 2016/LTSC 2019, Server 2016/2019' "$($os.Caption) build $($os.BuildNumber)" $osOk
-if ($os.Caption -like '*Windows 10 Pro*') { Add-Result 'Windows' 'Windows 10 Pro note' 'Vnet/IP drivers and IT Security Tool not supported on Win10 Pro' 'Windows 10 Pro' $null }
+$osText = "$($os.Caption) build $($os.BuildNumber)"
+if ($isR103) {
+    # R1.03 (IM 36K01C10-01EN 3rd ed. §1)
+    $supported = @('Windows 10 Pro', 'Windows 10 Enterprise', 'Windows 10 IoT Enterprise', 'Windows Server 2016', 'Windows Server 2019', 'Windows Server IoT 2019')
+    $osOk = $false; foreach ($s in $supported) { if ($os.Caption -like "*$s*") { $osOk = $true } }
+    Add-Result 'Windows' 'Operating system' 'Win10 Pro/Enterprise/IoT LTSB 2016/LTSC 2019, Server 2016/2019' $osText $osOk
+    if ($os.Caption -like '*Windows 10 Pro*') { Add-Result 'Windows' 'Windows 10 Pro note' 'Vnet/IP drivers and IT Security Tool not supported on Win10 Pro' 'Windows 10 Pro' $null }
+}
+else {
+    # R1.05 (IM 36K01C10-01EN 5th ed. §1.3.2): Server editions are listed as Standard only
+    $supported = @(
+        'Windows 10 (IoT )?Enterprise LTSC (2019|2021)',
+        'Windows 11 (Pro|Enterprise)\b',
+        'Windows 11 IoT Enterprise LTSC 2024',
+        'Windows Server (IoT )?(2019|2022|2025) Standard'
+    )
+    $osOk = $false; foreach ($s in $supported) { if ($os.Caption -match $s) { $osOk = $true } }
+    Add-Result 'Windows' 'Operating system' 'Win10 (IoT) Ent. LTSC 2019/2021, Win11 Pro/Ent., Win11 (IoT) Ent. LTSC 2024, Server (IoT) 2019/2022/2025 Standard' $osText $osOk
+    $noItSec = ($os.Caption -match 'Windows Server (IoT )?2025') -or (($os.Caption -match 'Windows 11') -and ($os.Caption -notmatch 'LTSC'))
+    if ($noItSec) { Add-Result 'Windows' 'Vnet/IP and IT security note' 'Vnet/IP drivers and IT Security Tool not supported on Win11 Pro/Ent. and Server 2025' $os.Caption $null }
+}
 
 # Visual effects: "Let Windows choose" = VisualFXSetting 0
 $vfx = Get-Reg 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\VisualEffects' 'VisualFXSetting'
@@ -66,7 +90,14 @@ Add-Result 'Windows' 'Fast startup (HiberbootEnabled)' '0' $hib ($hib -eq 0)
 # Windows Defender
 $defPol = Get-Reg 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender' 'DisableAntiSpyware'
 $defSvc = Get-Service WinDefend -ErrorAction SilentlyContinue
-Add-Result 'Windows' 'Windows Defender' 'turned off by policy (use Yokogawa-approved antivirus)' "policy DisableAntiSpyware=$defPol; service=$(if ($defSvc) { $defSvc.Status } else { 'none' })" ($defPol -eq 1)
+$defText = "policy DisableAntiSpyware=$defPol; service=$(if ($defSvc) { $defSvc.Status } else { 'none' })"
+# R1.05 exceptions (IM 36K01C10-01EN 5th ed. §2.1.2, IM 36K01C30-01EN 5th ed. §3.5.4):
+# Win11 Pro 24H2 (build 26100+) must keep Defender on; Win10 LTSC 2021 (build 19044) and Win11 LTSC 2024 cannot turn it off.
+$defKeepOn = (-not $isR103) -and ($os.Caption -match 'Windows 11 Pro') -and ([int]$os.BuildNumber -ge 26100)
+$defCannotOff = (-not $isR103) -and (($os.Caption -match 'Windows 11 .*LTSC') -or (($os.Caption -match 'Windows 10 .*LTSC') -and ([int]$os.BuildNumber -eq 19044)))
+if ($defKeepOn) { Add-Result 'Windows' 'Windows Defender' 'Win11 Pro 24H2: must stay on' $defText $null }
+elseif ($defCannotOff) { Add-Result 'Windows' 'Windows Defender' 'Win10 LTSC 2021 / Win11 LTSC 2024: cannot be turned off' $defText $null }
+else { Add-Result 'Windows' 'Windows Defender' 'turned off by policy (use Yokogawa-approved antivirus)' $defText ($defPol -eq 1) }
 
 # Automatic Windows updates
 $au = Get-Reg 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU' 'NoAutoUpdate'
@@ -107,18 +138,32 @@ foreach ($u in 'CIX_PROCESS', 'CTM_PROCESS') {
     $lu = Get-LocalUser -Name $u -ErrorAction SilentlyContinue
     Add-Result 'IT security' "Local user $u" 'exists' $(if ($lu) { "exists, enabled=$($lu.Enabled)" } else { 'missing' }) ([bool]$lu)
 }
-$itsec = Test-Path 'C:\Program Files (x86)\YOKOGAWA\IA\iPCS\Platform\Security'
-Add-Result 'IT security' 'IT Security Tool installed' 'yes, when installed with ciserver-...-ITSecurity.exe' $(if ($itsec) { 'yes' } else { 'no' }) $itsec
+# Program folder of the IT Security Tool; IT security 3.0 also puts its GPO file and settings PDF
+# under ProgramData (IM 36K01C10-01EN 5th ed. §2.1.6)
+$secPaths = @((Join-Path ${env:ProgramFiles(x86)} 'YOKOGAWA\IA\iPCS\Platform\Security'), (Join-Path $env:ProgramData 'Yokogawa\IA\iPCS\Platform\Security'))
+$found = @($secPaths | Where-Object { Test-Path $_ })
+$itsec = $found.Count -gt 0
+$v3 = Test-Path (Join-Path $env:ProgramData 'Yokogawa\IA\iPCS\Platform\Security\GPOFiles\3.0')
+$secText = if ($itsec) { "yes ($($found -join '; '))$(if ($v3) { '; IT security 3.0 files present' })" } else { 'no' }
+Add-Result 'IT security' 'IT Security Tool installed' 'yes, when installed with ciserver-...-ITSecurity.exe (or the IT security 3.0 installer)' $secText $itsec
 
 foreach ($p in (Get-NetFirewallProfile -ErrorAction SilentlyContinue)) {
     Add-Result 'Firewall' "Profile $($p.Name)" 'Enabled' $p.Enabled ($p.Enabled -eq $true)
 }
 $ports = @{ 'TCP 8080' = 8080; 'TCP 8443' = 8443; 'UDP 17001' = 17001; 'UDP 17101' = 17101; 'UDP 18002' = 18002 }
-$allow = Get-NetFirewallRule -Direction Inbound -Action Allow -Enabled True -ErrorAction SilentlyContinue | Get-NetFirewallPortFilter -ErrorAction SilentlyContinue
+# R1.05: RESTful API web server (jrstsrv.sup JRST_NETWORK_PORT), IM 36K01C30-01EN 5th ed. Table 3.2-1
+if (-not $isR103) { $ports['TCP 34597'] = 34597 }
+# A rule counts when it names the port, or allows any port without being limited to one program
+# (Windows' own "any port" rules such as Remote Desktop Shadow are program-limited and do not count).
+$allow = foreach ($r in (Get-NetFirewallRule -Direction Inbound -Action Allow -Enabled True -ErrorAction SilentlyContinue)) {
+    $pf = $r | Get-NetFirewallPortFilter -ErrorAction SilentlyContinue
+    $af = $r | Get-NetFirewallApplicationFilter -ErrorAction SilentlyContinue
+    [pscustomobject]@{ Protocol = $pf.Protocol; LocalPort = @($pf.LocalPort); AnyProgram = ($af.Program -eq 'Any' -and $af.Package -in @($null, '', 'Any')) }
+}
 foreach ($name in $ports.Keys) {
     $proto, $num = $name.Split(' ')
-    $hit = $allow | Where-Object { $_.Protocol -eq $proto -and ($_.LocalPort -contains "$num" -or $_.LocalPort -contains 'Any') }
-    Add-Result 'Firewall' "Inbound $name allowed" 'yes (web / secure web / DURM / SMDMON)' $(if ($hit) { 'yes' } else { 'no rule found' }) ([bool]$hit)
+    $hit = $allow | Where-Object { $_.Protocol -eq $proto -and ($_.LocalPort -contains "$num" -or ($_.LocalPort -contains 'Any' -and $_.AnyProgram)) }
+    Add-Result 'Firewall' "Inbound $name allowed" 'yes (web / secure web / DURM / SMDMON / RESTful API)' $(if ($hit) { 'yes' } else { 'no rule found' }) ([bool]$hit)
 }
 
 # --- Output --------------------------------------------------------------------