Merge pull request 'Phase 2-3: setup/security, Tutorial, new item and class/object skills' (#3) from docs/phase-2-setup-security into main

Reviewed-on: cliu/ci-server-config#3

.claude/skills/class-object-engineering/SKILL.md

@@ -0,0 +1,20 @@
+---
+name: class-object-engineering
+description: >-
+  CI Server R1.03 PROCESS Service classes, objects and trigger groups. Use when the user wants
+  to create a trigger group, write or compile a class (traditional language), create objects
+  from a class, or load classes and objects with quick load files. Sources IM 36K10G10-01EN
+  (Tutorial) and IM 36K10J10-01EN; to be extended with IM 36K10L10, P10 and P11 in phase 6.
+---
+
+# Class and object engineering (R1.03)
+
+Background: `knowledge/manuals/IM36K10G10-01EN.md` (chapter 5) and
+`knowledge/manuals/IM36K10J10-01EN.md` (sections 2.4 and 5.3). Known issues for PROCESS
+Service: `knowledge/manuals/IM36K01A50-01EN.md`.
+
+Rules: run `system-check` first; creating classes and objects changes the running system.
+
+| Task | File | Status |
+|---|---|---|
+| Trigger group, class (compiled on load) and object via quick load | `tasks/load-class-object.md` | verified |

.claude/skills/class-object-engineering/tasks/load-class-object.md

@@ -0,0 +1,68 @@
+---
+task: Create a trigger group, class and object with quick load files
+version: R1.03
+source: IM 36K10G10-01EN §5.1–5.3; IM 36K10J10-01EN §5.6; practiced with CI-Eng-Sample 2026-09-30
+status: verified
+---
+
+# Trigger group, class and object via quick load
+
+Load in this order (each with `dssqld -i <file>.qli -l <file>.qlo`, check `Errors` = 0);
+remove in reverse (object, class, trigger group) with `NAME`-only files and `dssqld -r`.
+
+**1. Trigger group** (`TRIGGER_DF`, name max 16 characters):
+
+```
+@FIELDS
+NAME,DESCRIPTION,TRIGGER_INTERVAL
+
+@TRIGGER_DF
+"CIENG_1S","CI-Eng-Sample one second trigger","1 seconds"
+```
+
+**2. Class** (`CLASS_DF`, name max 16 characters). The source goes in the `METHOD` memo field,
+between `@"` and `"@` on their own lines; `COMPILE` 1 compiles it on load; `TRIGGER_1`
+attaches a trigger group:
+
+```
+@FIELDS
+NAME,DESCRIPTION,PF_LANGUAGE,TRIGGER_1,COMPILE,LISTING_WANTED,METHOD
+
+@CLASS_DF
+"CIENG_INCR","Count CI-Eng-Sample.DEMO.COUNTER 1..100","Traditional","CIENG_1S",1,1,\
+@"
+CLASS CIENG_INCR;
+  PROLOG
+    SIGNAL INPUT := "CI-Eng-Sample.DEMO.COUNTER";
+  BODY
+    METHOD UP_AND_DOWN;
+      BODY
+        IF (INPUT >= 100) THEN
+          INPUT := 0;
+        ENDIF;
+        INPUT := INPUT + 1;
+    ENDMETHOD UP_AND_DOWN;
+ENDCLASS CIENG_INCR;
+"@
+```
+
+The item a `SIGNAL` names must exist first (or be created by the class with `FROM … MAKE`).
+
+**3. Object** (`OBJECT_DF`): full name in its section, and the class:
+
+```
+@FIELDS
+NAME,DESCRIPTION,CLASS
+
+@OBJECT_DF
+"CI-Eng-Sample.DEMO.INCR1","Counts DEMO.COUNTER every second","CIENG_INCR"
+```
+
+## Check
+
+Run `itmval -g -n CI-Eng-Sample.DEMO.COUNTER` a few seconds apart: the value rises by one per
+second. To inspect a class, export it with a filter file (`@SELECT`, then
+`'NAME = "<class>"'`, then `@CLASS_DF`).
+
+Example files: `examples/CI-Eng-Sample/05_trigger_df.qli`, `06_class_df.qli`, `07_object_df.qli`,
+`86_` to `88_remove_*.qli`.

.claude/skills/installation-security/SKILL.md

@@ -0,0 +1,32 @@
+---
+name: installation-security
+description: >-
+  CI Server R1.03 installation, upgrade and Windows/IT security. Use when the user wants to
+  prepare Windows for CI Server, check whether a machine meets the setup requirements, install,
+  reinstall, upgrade or uninstall CI Server, apply or extend a licence, install CI Server Remote
+  Connect, set up Vnet/IP drivers or network addresses, apply the IT Security Tool, check or
+  open firewall ports, manage the CIX_ groups and CIX_PROCESS account, or run CI Server on a
+  virtual machine. Sources IM 36K01C10-01EN and IM 36K01C30-01EN.
+---
+
+# Installation and security (R1.03)
+
+Background: `knowledge/manuals/IM36K01C10-01EN.md` (Setup) and
+`knowledge/manuals/IM36K01C30-01EN.md` (Security Guide). Known issues:
+`knowledge/manuals/IM36K01A50-01EN.md` (IT Security tool, install path, VMs).
+
+Rules:
+- Run the `system-check` skill first.
+- Installing, upgrading, changing Windows settings or IT security needs an elevated session,
+  changes the machine and often needs restarts: follow the user's chosen way of working and
+  confirm before each step. In *prepare only* mode, produce a checklist for the user.
+- Never copy old setup files over new ones after an upgrade: compare and merge.
+
+| Task | Where | Status |
+|---|---|---|
+| Check a machine against the setup and security requirements | `tasks/setup-check.md` | verified |
+| New installation (physical, VM, dual-redundant): order of work, Windows settings, Vnet/IP, install, IT security, licence | Setup summary §2 | from docs |
+| Start/stop, reinstall, upgrade (incl. HAC), extend licence, uninstall | Setup summary §3 | from docs |
+| Install CI Server Remote Connect; web ports | Setup summary §2.4 | from docs |
+| Firewall ports for CI Server and drivers | Security Guide summary §3 | from docs (web, DURM, SMDMON ports checked) |
+| IT Security Tool, user management types, CIX_ groups/accounts, change service account | Security Guide summary §2, §5 | from docs |

.claude/skills/installation-security/tasks/setup-check.md

@@ -0,0 +1,46 @@
+---
+task: Check a machine against the CI Server setup and security requirements
+version: R1.03
+source: IM 36K01C10-01EN §1, §2.1.2, §3.2.12; IM 36K01C30-01EN §2.2, §3.2; practiced on the test system 2026-09-30
+status: verified (2026-09-30)
+---
+
+# Setup check (read-only)
+
+```
+powershell -NoProfile -ExecutionPolicy Bypass -File tools\setup_check.ps1
+```
+
+Run from the repo root, preferably elevated. Changes nothing. One line per check:
+`[OK]` matches the manual, `[DIFF]` differs, `[CHECK]` needs a human decision.
+
+## What it checks
+
+| Area | Checks |
+|---|---|
+| CI Server | Installed version (1.03.00), CI Service state, startup type and account (`.\CIX_PROCESS`), VAGW service |
+| Windows | Supported OS, visual effects, processor scheduling, virtual memory (custom, 1.5 × RAM), power plan, fast startup, Windows Defender policy, automatic updates policy, scheduled defrag and component cleanup, .NET 3.5, DCOM authentication level, display scale, 8dot3 names, regional settings |
+| IT security | `CIX_OPERATOR`, `CIX_ENGINEER`, `CIX_MAINTENANCE`, `CIX_OPC` groups, `CIX_PROCESS` / `CTM_PROCESS` users, IT Security Tool installed |
+| Firewall | Profiles enabled; inbound allowed for TCP 8080, 8443, UDP 17001, 17101, 18002 |
+
+## Reading the result
+
+- `[DIFF]` on a development PC is normal; for a production server, fix each item with the
+  Setup summary's Windows settings table (`knowledge/manuals/IM36K01C10-01EN.md` §2) or by
+  running the IT Security Tool.
+- The script finds the firewall rules only as "some rule allows this port"; check the rule
+  scope separately for production.
+- Also read `%TLS_LOG_PATH%\ci_start.log` after a start: every service should report
+  `… started` and the log ends with `CI Server started`; look for `-E-` and `failed` lines.
+  The first lines show the version and build (e.g. `R1.03.00 … (r10200M)`).
+- The web ports actually used are `SECURE_PORT_NUMBER` / `NON_SECURE_PORT_NUMBER` in
+  `%TLS_ROOT_PATH%\tls\sup\jwuiisg.sup` (8443 / 8080 by default).
+
+## Test system result (2026-09-30)
+
+Windows 10 Pro 19045 development PC without the IT Security Tool: 16 OK, 5 CHECK, 15 DIFF.
+Differences: firewall domain/private profiles off; no `CIX_` groups or `CTM_PROCESS` (IT
+Security Tool not installed; not supported on Windows 10 Pro); fast startup on; Balanced power
+plan; automatic virtual memory; Defender on; automatic updates, defrag and cleanup not
+disabled. Web ports 8443/8080. `ci_start.log`: all services started, one SSL certificate error
+(`knowledge/issues.md` ISS-008).

.claude/skills/item-engineering/SKILL.md

@@ -0,0 +1,23 @@
+---
+name: item-engineering
+description: >-
+  CI Server R1.03 sections, items and sub-items. Use when the user wants to create or change
+  sections, items or sub-items (integrator, min-max, pulse, rate-of-change), set limits,
+  scale or value format, block or unblock items or sections, or understand item status and
+  option flags. Sources IM 36K10G10-01EN (Tutorial); to be extended with IM 36K10C10 in phase 5.
+---
+
+# Item engineering (R1.03)
+
+Background: `knowledge/manuals/IM36K10G10-01EN.md` (chapter 3). Bulk creation of sections and
+items uses quick load files: skill `system-management`, task `load-remove-records.md`.
+Reading and writing values: `system-management` task `read-write-item.md`.
+
+Rules:
+- Run the `system-check` skill first; follow the user's chosen way of working for any change.
+- Names: `Section.Sub-section.Item`, max 255 bytes, no `:` or `.` inside a name, case insensitive.
+
+| Task | File | Status |
+|---|---|---|
+| Sub-items (integrator, min-max) | `tasks/sub-items.md` | verified |
+| Block / unblock an item; write to a blocked item | `tasks/block-item.md` | verified |

.claude/skills/item-engineering/tasks/block-item.md

@@ -0,0 +1,36 @@
+---
+task: Block / unblock an item and write to a blocked item
+version: R1.03
+source: IM 36K10G10-01EN §3.3, §3.4; practiced with CI-Eng-Sample 2026-09-30
+status: verified
+---
+
+# Block / unblock an item
+
+A blocked item is not updated (e.g. during device maintenance). Blocking can be done per item,
+sub-item or section; sub-items of a blocked item keep working. **Changes live behaviour:**
+follow the user's chosen way of working.
+
+Block (`BLOCKED` 1) or unblock (`BLOCKED` 0) with an update file and `dssqld -m`:
+
+```
+@FIELDS
+NAME,BLOCKED
+
+@ITEM_DF
+"<Section>.<Tag>",1
+```
+
+```
+dssqld -m block.qli -l block.qlo
+```
+
+(Engineering Module: right-click the item or section › *Block/Unblock*.)
+
+## Behaviour (verified on `CI-Eng-Sample.TANK1.INFLOW`)
+
+- Blocked: option flag `blk` appears in `itmval -g`; the status number is unchanged (stayed 9).
+- `itmval -p -n <item> -v <value>` on a blocked item is **silently ignored** (no error, value
+  unchanged; `knowledge/issues.md` ISS-011). Add `-o` to overwrite:
+  `itmval -p -n <item> -v <value> -o`.
+- After unblocking, `blk` is replaced by `ublk` (meaning not yet confirmed, see ISS-001).

.claude/skills/item-engineering/tasks/sub-items.md

@@ -0,0 +1,37 @@
+---
+task: Create sub-items (integrator, min-max)
+version: R1.03
+source: IM 36K10G10-01EN §3.1.5, §3.2.3; practiced with CI-Eng-Sample 2026-09-30
+status: verified
+---
+
+# Sub-items
+
+A sub-item hangs under an item (`<Section>.<Tag>.<Sub>`) and processes the main item's value.
+Types: `Integrator`, `Min-Max`, `Pulse`, `Rate-of-Change`, `Typeless`. Sub-items cannot connect
+to equipment, cannot have sub-items, and are **not** blocked when the main item is blocked.
+
+Quick load (`SUB_ITEM_DF`; the main item must exist):
+
+```
+@FIELDS
+NAME,DESCRIPTION,SUB_TYPE,TIME_UNIT,MIN_MAX
+
+@SUB_ITEM_DF
+"CI-Eng-Sample.PUMP1.RUNNING.RUN_SECONDS","Pump 1 running time (seconds)","Integrator","",""
+"CI-Eng-Sample.TANK1.LEVEL.MAX","Tank 1 maximum level","Min-Max","","Maximum"
+```
+
+Load with `dssqld -i <file>.qli -l <file>.qlo`; remove with a `NAME`-only file and `dssqld -r`
+(before removing the main item).
+
+## Behaviour (verified)
+
+- **Integrator** adds *value × seconds*: with the main item at 1 it grows by 1 per second.
+  `TIME_UNIT` (e.g. `Hour`) made no difference (`knowledge/issues.md` ISS-010); to show hours,
+  divide by 3600 where the value is used.
+- **Min-Max** with `MIN_MAX` = `Maximum` (or `Minimum`) keeps the highest (lowest) value
+  written to the main item: writing 30, 70, 50 gave 70.
+- `TIME_UNIT` (Second, Minute, Hour, Day) belongs to Rate-of-Change (from docs, not practiced).
+
+Example files: `examples/CI-Eng-Sample/02b_sub_item_df.qli`, `90b_remove_sub_item_df.qli`.

examples/CI-Eng-Sample/01_section_df.qli

@@ -13,3 +13,4 @@ NAME,SECTION_PATH,SECTION_NAME,DESCRIPTION
 "CI-Eng-Sample.TANK1","CI-Eng-Sample","TANK1","Sample tank 1"
 "CI-Eng-Sample.PUMP1","CI-Eng-Sample","PUMP1","Sample pump 1"
 "CI-Eng-Sample.SYSTEM","CI-Eng-Sample","SYSTEM","Sample system monitoring"
+"CI-Eng-Sample.DEMO","CI-Eng-Sample","DEMO","Tutorial examples (class/object)"

examples/CI-Eng-Sample/02_item_df.qli

@@ -18,3 +18,4 @@ LOW_LOW_LIMIT,LOW_LIMIT,HIGH_LIMIT,HIGH_HIGH_LIMIT,SCALE_LOW_LIMIT,SCALE_HIGH_LI
 "CI-Eng-Sample.SYSTEM.DISK_C","Disk C: from intdskmon","Real","999.9",0,0,0,0,0,100
 "CI-Eng-Sample.SYSTEM.PING_LOCALHOST","localhost reachable, from inttcpmon","Integer","9",0,0,0,0,0,1
 "CI-Eng-Sample.SYSTEM.PROC_ALM","ALARM process (alm) running, from intmon","Integer","9",0,0,0,0,0,1
+"CI-Eng-Sample.DEMO.COUNTER","Counter 1..100 driven by object DEMO.INCR1","Integer","999",0,0,0,0,0,100

examples/CI-Eng-Sample/02b_sub_item_df.qli

@@ -0,0 +1,15 @@
+@LANGUAGE
+ENGLISH
+
+@VERSION
+1.03.00
+
+! CI-Eng-Sample sub-items (Tutorial IM 36K10G10-01EN 3.1.5, 3.2.3), CI Server R1.03.00
+! Integrator: adds value x seconds (RUNNING = 1 -> running seconds; TIME_UNIT has no effect, verified).
+! Min-Max: keeps the maximum (or minimum) of the main item.
+@FIELDS
+NAME,DESCRIPTION,SUB_TYPE,TIME_UNIT,MIN_MAX
+
+@SUB_ITEM_DF
+"CI-Eng-Sample.PUMP1.RUNNING.RUN_SECONDS","Pump 1 running time (seconds)","Integrator","",""
+"CI-Eng-Sample.TANK1.LEVEL.MAX","Tank 1 maximum level","Min-Max","","Maximum"

examples/CI-Eng-Sample/05_trigger_df.qli

@@ -0,0 +1,12 @@
+@LANGUAGE
+ENGLISH
+
+@VERSION
+1.03.00
+
+! CI-Eng-Sample trigger group: every second (CI Server R1.03.00)
+@FIELDS
+NAME,DESCRIPTION,TRIGGER_INTERVAL
+
+@TRIGGER_DF
+"CIENG_1S","CI-Eng-Sample one second trigger","1 seconds"

examples/CI-Eng-Sample/06_class_df.qli

@@ -0,0 +1,26 @@
+@LANGUAGE
+ENGLISH
+
+@VERSION
+1.03.00
+
+! CI-Eng-Sample class (traditional language), compiled on load (COMPILE = 1)
+! Based on the INCREMENT example in the CI Server Tutorial (IM 36K10G10-01EN 5.2)
+@FIELDS
+NAME,DESCRIPTION,PF_LANGUAGE,TRIGGER_1,COMPILE,LISTING_WANTED,METHOD
+
+@CLASS_DF
+"CIENG_INCR","Count CI-Eng-Sample.DEMO.COUNTER 1..100","Traditional","CIENG_1S",1,1,@"
+CLASS CIENG_INCR;
+  PROLOG
+    SIGNAL INPUT := "CI-Eng-Sample.DEMO.COUNTER";
+  BODY
+    METHOD UP_AND_DOWN;
+      BODY
+        IF (INPUT >= 100) THEN
+          INPUT := 0;
+        ENDIF;
+        INPUT := INPUT + 1;
+    ENDMETHOD UP_AND_DOWN;
+ENDCLASS CIENG_INCR;
+"@

examples/CI-Eng-Sample/07_object_df.qli

@@ -0,0 +1,12 @@
+@LANGUAGE
+ENGLISH
+
+@VERSION
+1.03.00
+
+! CI-Eng-Sample object created from class CIENG_INCR
+@FIELDS
+NAME,DESCRIPTION,CLASS
+
+@OBJECT_DF
+"CI-Eng-Sample.DEMO.INCR1","Counts DEMO.COUNTER every second","CIENG_INCR"

examples/CI-Eng-Sample/86_remove_object_df.qli

@@ -0,0 +1,12 @@
+@LANGUAGE
+ENGLISH
+
+@VERSION
+1.03.00
+
+! Remove CI-Eng-Sample objects
+@FIELDS
+NAME
+
+@OBJECT_DF
+"CI-Eng-Sample.DEMO.INCR1"

examples/CI-Eng-Sample/87_remove_class_df.qli

@@ -0,0 +1,12 @@
+@LANGUAGE
+ENGLISH
+
+@VERSION
+1.03.00
+
+! Remove CI-Eng-Sample classes
+@FIELDS
+NAME
+
+@CLASS_DF
+"CIENG_INCR"

examples/CI-Eng-Sample/88_remove_trigger_df.qli

@@ -0,0 +1,12 @@
+@LANGUAGE
+ENGLISH
+
+@VERSION
+1.03.00
+
+! Remove CI-Eng-Sample trigger groups
+@FIELDS
+NAME
+
+@TRIGGER_DF
+"CIENG_1S"

examples/CI-Eng-Sample/90b_remove_sub_item_df.qli

@@ -0,0 +1,13 @@
+@LANGUAGE
+ENGLISH
+
+@VERSION
+1.03.00
+
+! Remove CI-Eng-Sample sub-items
+@FIELDS
+NAME
+
+@SUB_ITEM_DF
+"CI-Eng-Sample.PUMP1.RUNNING.RUN_SECONDS"
+"CI-Eng-Sample.TANK1.LEVEL.MAX"

examples/CI-Eng-Sample/91_remove_item_df.qli

@@ -17,3 +17,4 @@ NAME
 "CI-Eng-Sample.SYSTEM.DISK_C"
 "CI-Eng-Sample.SYSTEM.PING_LOCALHOST"
 "CI-Eng-Sample.SYSTEM.PROC_ALM"
+"CI-Eng-Sample.DEMO.COUNTER"

examples/CI-Eng-Sample/92_remove_section_df.qli

@@ -12,4 +12,5 @@ NAME
 "CI-Eng-Sample.TANK1"
 "CI-Eng-Sample.PUMP1"
 "CI-Eng-Sample.SYSTEM"
+"CI-Eng-Sample.DEMO"
 "CI-Eng-Sample"

examples/CI-Eng-Sample/README.md

@@ -39,6 +39,13 @@ cmd /c "<repo>\examples\CI-Eng-Sample\remove.cmd"
 | `CI-Eng-Sample.SYSTEM.DISK_C` | Item, Real | Target for `intdskmon` (reports **used** %) |
 | `CI-Eng-Sample.SYSTEM.PING_LOCALHOST` | Item, Integer | Target for `inttcpmon` (1 = reachable) |
 | `CI-Eng-Sample.SYSTEM.PROC_ALM` | Item, Integer | Target for `intmon` (1 = `alm` process running) |
+| `CI-Eng-Sample.PUMP1.RUNNING.RUN_SECONDS` | Sub-item, Integrator | Running time in seconds (adds value × seconds) |
+| `CI-Eng-Sample.TANK1.LEVEL.MAX` | Sub-item, Min-Max | Highest level seen |
+| `CI-Eng-Sample.DEMO` | Section | Tutorial examples |
+| `CI-Eng-Sample.DEMO.COUNTER` | Item, Integer | Counts 1…100, one step per second, written by `DEMO.INCR1` |
+| `CIENG_1S` | Trigger group | Every second |
+| `CIENG_INCR` | Class (traditional) | Increments `DEMO.COUNTER`, wraps at 100; compiled on load |
+| `CI-Eng-Sample.DEMO.INCR1` | Object | Instance of `CIENG_INCR` |
 | `CIENG_EVENT` | Item storage group | Event/Item, lifetime 1 week, rollover 1 day |
 
 All items are internal (no station), so the project works without any PLC or simulator.
@@ -50,9 +57,11 @@ New items start with status 13 (`NOT INIT`) until a value is written.
 |---|---|
 | `01_section_df.qli` | Sections (`SECTION_DF`); parents before children |
 | `02_item_df.qli` | Items (`ITEM_DF`) |
+| `02b_sub_item_df.qli` | Sub-items (`SUB_ITEM_DF`) |
 | `03_his_group_df.qli` | Item storage group (`HIS_GROUP_DF`) |
 | `04_item_his_df.qli` | Items in the storage group (`ITEM_HIS_DF`, name `<group>:<item>`) |
-| `89_`…`92_remove_*.qli` | Names to delete, in reverse order |
+| `05_trigger_df.qli`, `06_class_df.qli`, `07_object_df.qli` | Trigger group, class (source in the `METHOD` memo, `@"` … `"@`, `COMPILE` 1), object |
+| `86_`…`92_remove_*.qli` | Names to delete, in reverse order |
 | `load.cmd`, `remove.cmd` | Run the steps in the right order |
 | `monitoring/*.sup.txt` | Setup-file lines for the monitoring processes (not applied by `load.cmd`) |
 
@@ -67,7 +76,7 @@ testing. See the `system-management` skill, task `monitoring-processes.md`.
 
 | Phase | Adds |
 |---|---|
-| 6 | Template items, a class and objects |
+| 6 | Template items, a class with attributes/prompts, objects that create items |
 | 8 | Alarm settings on sample items |
 | 9 | More storage groups (scan/time, aggregation) |
 | 10 | A display and symbol |

examples/CI-Eng-Sample/load.cmd

@@ -6,7 +6,12 @@ rem Restart CI Server afterwards: new storage groups only start storing after a
 cd /d "%~dp0"
 dssqld -i 01_section_df.qli -l 01_section_df.qlo
 dssqld -i 02_item_df.qli -l 02_item_df.qlo
+dssqld -i 02b_sub_item_df.qli -l 02b_sub_item_df.qlo
 dssqld -i 03_his_group_df.qli -l 03_his_group_df.qlo
 rem Short pause: linking items straight after creating the group failed once.
 powershell -NoProfile -Command "Start-Sleep -Seconds 5"
 dssqld -i 04_item_his_df.qli -l 04_item_his_df.qlo
+rem Processing: trigger group, class (compiled on load via COMPILE = 1), object
+dssqld -i 05_trigger_df.qli -l 05_trigger_df.qlo
+dssqld -i 06_class_df.qli -l 06_class_df.qlo
+dssqld -i 07_object_df.qli -l 07_object_df.qlo

examples/CI-Eng-Sample/remove.cmd

@@ -1,16 +1,20 @@
 @echo off
 rem Remove CI-Eng-Sample from a CI Server R1.03 TEST system (also deletes its history).
 rem Run in an elevated prompt while CI Server is running; call this script by full path.
-rem Order: storage links, stop + delete storage group, items, sections (children first).
+rem Order: object, class, trigger group, storage links, stop + delete storage group, items, sections (children first).
 rem A storage group with an active unit cannot be deleted (HIS-E-GROUPHASUNT), so the
 rem group first gets a stop time one minute ahead; the script waits until it has passed.
 cd /d "%~dp0"
+dssqld -r 86_remove_object_df.qli -l 86_remove_object_df.qlo
+dssqld -r 87_remove_class_df.qli -l 87_remove_class_df.qlo
+dssqld -r 88_remove_trigger_df.qli -l 88_remove_trigger_df.qlo
 dssqld -r 89_remove_item_his_df.qli -l 89_remove_item_his_df.qlo
 powershell -NoProfile -Command "$t=(Get-Date).AddMinutes(1).ToString('dd-MM-yyyy HH:mm:ss'); \"@LANGUAGE`r`nENGLISH`r`n`r`n@VERSION`r`n1.03.00`r`n`r`n@FIELDS`r`nNAME,STOP_TIME`r`n`r`n@HIS_GROUP_DF`r`n\"\"CIENG_EVENT\"\",\"\"$t\"\"`r`n\" | Set-Content -Encoding ascii 90a_stop_his_group_df.qli"
 dssqld -m 90a_stop_his_group_df.qli -l 90a_stop_his_group_df.qlo
 echo Waiting 75 seconds for the storage group stop time to pass...
 powershell -NoProfile -Command "Start-Sleep -Seconds 75"
 dssqld -r 90_remove_his_group_df.qli -l 90_remove_his_group_df.qlo
+dssqld -r 90b_remove_sub_item_df.qli -l 90b_remove_sub_item_df.qlo
 dssqld -r 91_remove_item_df.qli -l 91_remove_item_df.qlo
 dssqld -r 92_remove_section_df.qli -l 92_remove_section_df.qlo
 del 90a_stop_his_group_df.qli

knowledge/issues.md

@@ -19,10 +19,15 @@ development system (see "Test system" in `progress.md`); they do not exist on ot
 
 | ID | Date | Area | Issue | Status | Next step / resolution | Update on close |
 |---|---|---|---|---|---|---|
-| ISS-001 | 2026-09-30 | ITEM (`itmval`) | Writing an item with `itmval -p -n AID.WRPS.SIM.INFLOW -v 400` added the `uoff` option flag (options 0x…8a → 0x…8e). The flag stayed after writing the original value back. Meaning of `uoff` unknown; not found in the EN manuals by text search. | open | 2026-09-30: writing internal sample items (`CI-Eng-Sample.*`, no station) does **not** set `uoff` (options stay 0x…88), so it is tied to station-connected items (the AID item was already `off`, its station not communicating). Still to find: meaning and how to clear it (ITEM Service IM 36K10L35/L36, Engineering Module I/O Processes IM 36K10C10). Revisit in phase 5 with a station item. | `.claude/skills/system-management/tasks/read-write-item.md` (replace the `uoff` note under "Read the current value"); `knowledge/progress.md` row "Write an item with `itmval -p`" |
+| ISS-001 | 2026-09-30 | ITEM (`itmval`) | Writing an item with `itmval -p -n AID.WRPS.SIM.INFLOW -v 400` added the `uoff` option flag (options 0x…8a → 0x…8e). The flag stayed after writing the original value back. Meaning of `uoff` unknown; not found in the EN manuals by text search. | open | 2026-09-30: writing internal sample items (`CI-Eng-Sample.*`, no station) does **not** set `uoff` (options stay 0x…88), so it is tied to station-connected items (the AID item was already `off`, its station not communicating). Still to find: meaning and how to clear it (ITEM Service IM 36K10L35/L36, Engineering Module I/O Processes IM 36K10C10). Revisit in phase 5 with a station item. 2026-09-30 later: unblocking a sample item left the flag `ublk` (after `blk` was cleared), so `u…` flags may mean "was …" (un-blocked / un-offline). Still unconfirmed. | `.claude/skills/system-management/tasks/read-write-item.md` (replace the `uoff` note under "Read the current value"); `knowledge/progress.md` row "Write an item with `itmval -p`" |
 | ISS-002 | 2026-09-30 | DATABASE (`dsschk`) | `dsschk -d ITEM_DF -v` (check only) exits 0 with no console output and nothing new in `umhlog.log`. Where results are reported is unknown. | closed | Closed 2026-09-30 (confirmed by user). 2026-09-30: `dsschk -e -v` prints a start/end line per dataset (228 checked, no problems) and logs to `umhlog.log`. Plain `dsschk` only compares copies between nodes, so it prints nothing on a single-node system. `ismchk` needs a database file name (usage: `ismchk data_base_name`), not run yet. | Create `.claude/skills/system-management/tasks/consistency-check.md` and add it to that skill's `SKILL.md`; `knowledge/manuals/IM36K10J10-01EN.md` §4.1.1 consistency tools (add where output goes); `knowledge/progress.md` row "Consistency check" |
 | ISS-003 | 2026-09-30 | DATABASE (`dssqld`) | Filtered export (`dssqld -e <out> <filter>.qli`) failed with a guessed filter syntax (`@ITEM_DF`, `@FIELD`, `@SELECT`). | closed | Closed 2026-09-30 (confirmed by user). 2026-09-30: the quick load **data** format is now known and verified (`@LANGUAGE`, `@VERSION`, `@FIELDS`, `@<DATASET>`, quoted CSV records, `\` continuation, `!` comments; IM 36K10L45 §9.11). Filter syntax found (IM 36K10L50 §3.6) and practiced, awaiting confirmation: a file with `@SELECT`, then the filter in single quotes (strings in double quotes), then `@<DATASET>`; run `dssqld -e <out> <filter>.qli`. `ITEM_HISTORY` returns nothing unless the filter names `ITEM_NAME` and a `SAMPLE_TIME` range (`SAMPLE_TIME > "dd-mm-yyyy hh:mm:ss" and SAMPLE_TIME < ...`). | `.claude/skills/system-management/tasks/export-dataset.md` section "Filtered exports"; `knowledge/manuals/IM36K10J10-01EN.md` §5.6 step 1; `knowledge/progress.md` row "Export a dataset" |
 | ISS-004 | 2026-09-30 | ITEM (`itmval`) | `itmval -g -a <1..5>` returns `ITM-E-WRONG_ATT` on `AID.WRPS.*` items, so reading limits is unproven. | closed | Closed 2026-09-30 (confirmed by user). On `CI-Eng-Sample.TANK1.LEVEL` (limits set) `-a 1..5` returned deadband 0, low 20, high 80, low-low 10, high-high 90. The error only occurs on items without limits. | `.claude/skills/system-management/tasks/read-write-item.md` (limits section); `knowledge/progress.md` row "Read an item with `itmval -g`" |
 | ISS-005 | 2026-09-30 | DATABASE (`dssqld`) | Loading `04_item_his_df.qli` straight after creating the storage group gave 2 errors once; three other runs were clean. Error text not captured. | open | Added a 5 s pause in `load.cmd`. If it happens again, capture `04_item_his_df.qlo`. | `examples/CI-Eng-Sample/load.cmd`; `.claude/skills/system-management/tasks/load-remove-records.md` |
 | ISS-006 | 2026-09-30 | HISTORY (`ithloahis`) | Samples dated before the start of the current storage unit were not stored (no error shown); samples after it were. Also, a new storage group stored nothing until CI Server was restarted. | open | Confirm with History Management (IM 36K10L20) in phase 9: how to load into older units, and whether a restart is really required. | `.claude/skills/system-management/tasks/load-history.md`; `examples/CI-Eng-Sample/README.md`; `knowledge/manuals/IM36K10J10-01EN.md` command-line tools |
 | ISS-007 | 2026-09-30 | INTEGRATION (monitoring) | `intdskmon` wrote 61.9 for a C: drive that is 61.9 % used / 38.1 % free, although the manual says it monitors the disk free space rate. `intspawn` did nothing when the command path was ~130 characters; a short path worked (limit unknown). | open | Confirm the disk value meaning and the path limit. | `.claude/skills/system-management/tasks/monitoring-processes.md`; `knowledge/manuals/IM36K10J10-01EN.md` §4.1.6; `examples/CI-Eng-Sample/monitoring/` |
+| ISS-008 | 2026-09-30 | ACCESS (web/OPC UA server?) | `ci_start.log` on the test system shows `CppServerAPI::Run() failed: InitializeSslCtx(): SSL_CTX_use_certificate_chain_file() failed.` right after ACCESS Service starts. Which component and certificate is not known. | open | Identify in phase 7 (OPC Interface IM 36K10E20, Data Access IM 36K10L45). | `.claude/skills/installation-security/tasks/setup-check.md`; the phase 7 skill |
+| ISS-009 | 2026-09-30 | Security Guide | DCOM port range printed as 20500–20550 in the firewall table but "2500–20550" in the OPC configuration table. Taken as a typo for 20500–20550. | open | Confirm on a system with IT security applied. | `knowledge/manuals/IM36K01C30-01EN.md` §4 |
+
+| ISS-010 | 2026-09-30 | ITEM (sub-items) | The Integrator sub-item adds value × seconds; setting `TIME_UNIT` = Hour made no difference (1 per second while the main item was 1). The Tutorial lists a time unit only for Rate-of-Change. | open | Confirm with ITEM Service manuals (IM 36K10L35/L36) in phase 5: is there a scaling option for integrators? | `examples/CI-Eng-Sample/02b_sub_item_df.qli`; `knowledge/manuals/IM36K10G10-01EN.md` |
+| ISS-011 | 2026-09-30 | ITEM (blocking) | A write to a blocked item with `itmval -p` (without `-o`) is silently ignored: no error message, value unchanged. | open | Check in phase 5 whether any status/return code signals this. | `.claude/skills/system-management/tasks/read-write-item.md` |

knowledge/manuals/IM36K01C10-01EN.md

@@ -0,0 +1,159 @@
+---
+manual: IM 36K01C10-01EN
+title: CI Server Setup
+edition: 3rd Edition, Sep. 2023
+version: R1.03
+status: from docs (Windows settings checked read-only on the test system with tools/setup_check.ps1)
+---
+
+# CI Server Setup (R1.03)
+
+New installation, maintenance (start/stop, reinstall, upgrade, licence, uninstall) and network
+tools. Section numbers refer to the manual.
+
+## 1. Before you start
+
+- Needed: the CI Server software medium (or its ISO) and one **Activated License File per
+  server** (an upgrade needs one that includes the Upgrade License).
+- Supported OS for R1.03: Windows 10 Pro / Enterprise (64-bit), Windows 10 Enterprise and IoT
+  Enterprise 2016 LTSB and 2019 LTSC, Windows Server 2016, Windows Server 2019, Windows Server
+  IoT 2019. On **Windows 10 Pro/Enterprise (non-LTSB/LTSC) the Vnet/IP drivers and the IT
+  Security Tool are not supported**. VMs run Windows Server 2019.
+- Only listed software may coexist: Chrome / Firefox / Edge 112, Microsoft Office 2016/2019/365
+  (Excel Add-in), PI AF SDK 2.10.5 + .NET 4.6.2, Adobe Acrobat (Reader) DC, Yokogawa standard
+  antivirus, Standard Whitelisting Software for Endpoint Security. Anything else may disturb CI Server.
+
+## 2. New setup
+
+### Order of work (§2.1, physical machine)
+
+1. (Vnet/IP only) Set DIP switches and fit the Vnet/IP card (VI702).
+2. Configure Windows settings (below).
+3. (Vnet/IP only) Install control bus driver and Vnet/IP open communication driver, then set
+   Windows network settings.
+4. Install CI Server (with or without the IT Security Tool).
+5. Apply IT security settings (IT Security Tool; Domain Link Management Tool for linked domain).
+6. Apply the CI Server licence.
+
+On a VM (§2.2): mount the ISO, Windows settings, (Vnet/IP) **Vnet/IP Interface Package**
+instead of drivers/card, VM network settings, install, IT security, licence, then VM
+settings (auto start/shutdown with host, allow RDP from thin clients, disable NetBIOS over
+TCP/IP, network metrics favouring the plant network). On VMs, adapters not used for Vnet/IP
+must not use 192.168.0.0/16. Dual-redundant platform: see §2.3 and IM 30A05C30.
+
+### Windows settings (§2.1.2)
+
+| Setting | Required value |
+|---|---|
+| Security patches | Apply per company policy before going live; patch promptly later |
+| Visual effects | *Let Windows choose what's best* |
+| Processor scheduling | *Programs* |
+| Virtual memory | Custom size, initial = maximum = 1.5 × RAM (e.g. 6 GB RAM → 9216 MB); restart |
+| Power | *High performance*; disk, sleep, hibernate, display: never; hybrid sleep off; wake timers off; power button = shut down |
+| Fast startup | Off: run `<DVD>\Windows\Tool\HiberbootDisabled.bat` as administrator (`HiberbootEnabled` = 0); required before Vnet/IP drivers on Win10 |
+| Windows Defender | Turned off by group policy (Server 2016: *Turn off Windows Defender*; 2019: *Turn off Windows Defender Antivirus*) |
+| Automatic Windows updates | Disabled by group policy (*Configure Automatic Updates* = Disabled). With WSUS: install CI Server first, then disable from WSUS |
+| Drive optimization | Scheduled optimization off |
+| Automatic cleanup | Task Scheduler › Microsoft › Windows › Servicing › `StartComponentCleanup` disabled |
+| Windows updates | KB5023702 (2023-03) on Win10 2019 LTSC / Server 2019, or folder permissions may be wrong |
+| .NET Framework 3.5.1 | Installed (`dism /online /enable-feature /featurename:NetFX3 /all /Source:<DVD>:\sources\sxs /limitaccess`, or Server Manager feature) |
+| DCOM | Default Authentication Level = *Connect*; restart |
+| Display | Scale 100 % |
+| 8dot3 names | `fsutil behavior set disable8dot3 2`; restart |
+
+### Vnet/IP (§2.1.1, §2.1.3, §2.1.4)
+
+- Card DIP switches: domain 1–16, station 1–64 (start from 64 downwards), each with odd
+  parity; action-mode switch all OFF. One card per computer; card before drivers.
+- Drivers from `<DVD>\Windows\VnetVirtualProduct\VirtualProduct_CIServer_package*.zip` →
+  `installVirtProd.cmd` (VM: `installVirtProdVPF.cmd`), as administrator, antivirus off.
+- Rename connections: *Ethernet*, *Vnet*, *VnetIPOpen* (VM: *VnetIPBUS1*, *VnetIPBUS2*,
+  *RemoteUINetwork*). Disable IPv6; Vnet uses only *Yokogawa Vnet Protocol* + IPv4.
+- Default addresses: Ethernet `172.17.<domain>.<station>`/16; control bus `172.16.<domain>.<station>`/16;
+  Vnet/IP open `192.168.<128+domain>.<129+station>`/24; VM remote UI `172.18.<domain>.<station>`/16.
+- Computer name = station name. Check `sc query VLTDI` = RUNNING.
+- Never use Internet Connection Sharing, bridge connections or Homegroup.
+- Run the TCP/IP Inconsistency Detect Tool before installing CI Server (§3.8).
+
+### Installing CI Server (§2.1.5)
+
+- Run as a local administrator (domain types: domain admin or local admin + domain credentials);
+  join the domain first for domain/combination management.
+- Close applications, disable antivirus, never run two installers, never install where CI
+  Server Remote Connect is installed.
+- `<DVD>\Windows\CIServer\ciserver-R<ver>-r<build>M-setup.exe` = CI Server only;
+  `…-ITSecurity.exe` = CI Server + IT Security Tool (also installs VAGW modules; install type
+  *CI Server and IT Security Tool*). Choose the install folder (no spaces if non-default,
+  see known issues), reboot.
+- **Change the initial passwords of the predefined CI Server user accounts** (Engineering
+  Module manual).
+
+### IT security (§2.1.6) and licence (§2.1.7)
+
+- IT Security Tool: select *Standard Model* and the user management type; keep default items;
+  restart. The model must be the same across the system. Save/export settings if you change
+  defaults. Running the tool (also during upgrade) overwrites manual security changes.
+- Licence: Start menu › *License Authorization Wizard* (admin) › select the activated licence
+  file › Finish.
+
+### CI Server Remote Connect (§2.4)
+
+On a CI View PC (never on a Portal or Core): browse to `http(s)://<portal>:<port>` (defaults
+8080 / 8443), *Download (Windows)*, run `CI-rc-setup.exe`. Portal ports are in `jwuiisg.sup`
+(Setup File Editor › *Client communication* tab); open them in the firewalls.
+
+### Virtualization extras (§2.5)
+
+RD Session Host + RD Licensing (per device) for USB redirection; limit connections to 1;
+allow multiple sessions per user; enable *Windows Audio* and the *System Sound Service* task
+for sound over RDP.
+
+## 3. Maintenance
+
+**Start/stop (§3.1)**: Start menu › CI Server › *Start CI Server* / *Stop CI Server*, or the
+*CI Service* Windows service (set startup type *Automatic* for automatic start). An expired
+licence gives an error at start.
+
+**Reinstall / upgrade (§3.2)**, upgrades from R1.02 or earlier (needs a Product Maintenance
+Licence):
+1. Database consistency: `dsschk`, `dsschk -r`, `dsschk -e`, `dsschk -e -r` (upgrade only).
+2. Stop CI Server; set the CI Service startup type to *Manual*.
+3. Stop the *VAGW Bossd* service, then back up `%TLS_ALLUSERS_PATH%` and `%TLS_ROOT_PATH%\tls`
+   (plus project files).
+4. On the Core (upgrade): delete in `%TLS_SAV_PATH%` `eqp*_main.*`, `eqp*_item.*`, `opx*.*`
+   (`.sav/.d01/.k01`) and `*.sqlite`.
+5. Note changed setup files (Setup File Editor, *Status* = Changed) and copy
+   `tls\com`, `sup`, `tpl`, `src` and `%TLS_ALLUSERS_PATH%\wap`.
+6. (Vnet/IP) Update drivers (uninstall, reinstall, restart) and network settings.
+7. Install over the top (no uninstall); if IT Security Tool was installed before, install it again.
+8. IT security, licence.
+9. Restore: **compare and merge** changes into the new files (never copy old files over new
+   ones), including `wap\cfg\operatorInterfaces\DEPLOY\layouts\`; re-apply IT security.
+10. Verify: start, `dsschk -e -r` three times, restart, check `%TLS_LOG_PATH%\ci_start.log`,
+    restore the startup type.
+- ODBC: if the Simba client version differs, remove DSNs, uninstall and reinstall the client;
+  on R1.02 or older with the Simba server, uninstall the server before upgrading.
+- Passwords of predefined CI Server accounts are reset to the initial ones: change them again.
+
+**HAC upgrade (§3.3)**: stop standby, disconnect its network, upgrade and test offline, stop
+standby, stop primary, reconnect standby and start it, upgrade primary, start it (sync resumes).
+
+**Extend licence (§3.4)**: License Authorization Wizard while running; node name/number must
+match; takes effect within an hour. New features need CI Server stopped first.
+
+**Uninstall (§3.5, §3.6)**: back up, stop CI Server and VAGW Bossd, Programs and Features ›
+CI Server › Uninstall, restart. Remote Connect: uninstall it, then CI Server (IT Security
+definitions), then run `<DVD>\Windows\CIServer\ITSecurity\DeleteITSecurity.cmd`.
+
+**TCP/IP tools (§3.8)**: from the VirtualProduct package `XCM3003\Module\Tool`:
+`TcpipInconsistencyDetector.cmd` (check) and `TcpipInconsistencyRepair.cmd` (resets all NIC
+IPv4 settings: note them first, re-enter after restart).
+
+## Troubleshooting (Appendix 1)
+
+| Problem | Workaround |
+|---|---|
+| Server Manager error, Microsoft updates fail (80070543), .NET install fails | Temporarily set DCOM Default Authentication Level to *Connect* (revert to *None* afterwards where the manual says so), restart |
+| Cannot manage users in Control Panel | Use Computer Management › Local Users and Groups |
+| Installed updates not listed | `wmic qfe list full` |
+| Cannot change time zone (Server 2019 with UAC) | Run `timedate.cpl` as administrator |

knowledge/manuals/IM36K01C30-01EN.md

@@ -0,0 +1,114 @@
+---
+manual: IM 36K01C30-01EN
+title: CI Server Security Guide
+edition: 3rd Edition, Sep. 2023
+version: R1.03
+status: from docs (users/groups and firewall checked read-only on the test system)
+---
+
+# CI Server Security Guide (R1.03)
+
+What the IT Security Tool changes, which Windows accounts and firewall openings CI Server
+needs, and the related utilities. Section numbers refer to the manual.
+
+## 1. Threats and measures
+
+- Threats: attacks over the network, direct attacks at a terminal, theft of a computer/data.
+- Measures: access control (files, folders, registry, DCOM/OPC, system commands), personal
+  firewall, stopping unused services, IT environment settings (NetBIOS, disk password), and
+  group policies (password/lockout, security options, software restriction, audit policies,
+  administrative templates, safe DLL search order).
+- IT security settings **must** be applied at the area and process levels; business and
+  corporate levels follow the site's own policy.
+
+## 2. Security model and user management
+
+- CI Server supports only the **Standard model**: protects against network and terminal
+  attacks, **not** against theft. Password and lockout policies are *not* set by it (use
+  domain policy).
+- User management types:
+
+| Type | Accounts kept on | Notes |
+|---|---|---|
+| Standalone | Each computer | Small systems; admin and product maintenance rights not separable |
+| Domain | Domain controller | Central; rights separable |
+| Combination | Domain, plus local fallback | Local `_LCL` groups for emergencies |
+| Linked domain (recommended for new systems) | Domain, linked to local groups | Apply *Standalone* first, join domain, then link with Domain Link Management Tool |
+
+- Groups/accounts created by the IT Security Tool (standalone: local; domain types: on the
+  domain controller, with `_LCL` local helper groups):
+
+| Name | Kind | Purpose |
+|---|---|---|
+| `CIX_OPERATOR` | Group | Operators |
+| `CIX_ENGINEER` | Group | Engineering (Engineering / Edit Module) |
+| `CIX_MAINTENANCE` | Group (also Administrators) | Installation and maintenance |
+| `CIX_OPC` | Group | OPC configuration and communication |
+| `CIX_PROCESS` | User | Runs CI Server services and CI OPC servers |
+| `CTM_PROCESS` | User | Runs VAGW services |
+| `RDC_PROCESS` | User | Dual-redundant platform only |
+| `VNT_*` | Groups/users | Vnet/IP Interface Package (no sign-in rights) |
+
+Use these accounts only for CI Server. Changing the security model may delete or rename groups.
+
+## 3. Firewall (§3.2)
+
+Windows Firewall on; block everything except what CI Server needs:
+
+| Use | Port |
+|---|---|
+| Web / secure web (CI View, CI Portal) | TCP 8080 / 80, TCP 8443 / 443 |
+| DURM between nodes | UDP 17001, 17101 (one per DURM line) |
+| SMDMON (system log collection) | UDP 18002 |
+| Remote desktop (only if needed, restrict users) | TCP 3389 |
+| HAC | UDP 16000–16006 (`hac.sup`, `jhacProperties\application.properties`); HACW_HMI UDP 16010–16041 |
+| ODBC (SimbaServer, Core only) | TCP 1583 |
+| Alarm e-mail | TCP 25 |
+| NTP/SNTP (not needed with Vnet/IP) | 123 |
+| OPC classic | TCP 135, 139, DCOM 20500–20550 (customizable); UDP 137, 138 |
+| OPC UA | UDP 4840 discovery; communication port configurable |
+| Vnet equipment (`odeq.exe`) | TCP 44818 |
+| Equipment drivers | Rockwell CIP / PLC5 / Fisher ROC TCP 44818; DAQ TCP 34260, 34434; DNP3 TCP 20000; FA-M3 TCP 12289; IEC 60870-5-104 TCP 2404; IEC 61850 TCP 102; MeTro TCP 7075; Modbus TCP 502; STARDOM FCX TCP 1090 |
+| Windows domain | DNS 53, Kerberos 88, LDAP 389, SMB 445, GC 3268/3269, DHCP 67, discovery 137/138/1900/3702/5355 + TCP 2869/5357/5358, MADCAP 2535, AD Web 9389 |
+| Dual-redundant platform (PRC) | TCP 34480, 34483–34486; UDP 1311 |
+
+ICMP echo (ping) is allowed by the Standard model.
+
+## 4. Other settings (§3.3–§3.6)
+
+- Unused services disabled by the tool (depending on OS): Diagnostic Policy, Connected User
+  Experiences and Telemetry, dmwappushsvc, Downloaded Maps Manager, IP Helper, Program
+  Compatibility Assistant, Remote Registry, Shell Hardware Detection, Themes, Windows Push
+  Notifications, and others. DHCP Client must stay running.
+- OPC: *Create permanent shared objects* right for `CIX_OPC`, `CIX_PROCESS`, `CTM_PROCESS`;
+  network access sharing model *Classic*; DCOM port range 20500–20550 (the manual's table
+  also prints "2500–20550", taken as a typo).
+- NetBIOS over TCP/IP can be disabled (default with domain/combination management); then
+  configure HOSTS/DNS for name resolution.
+- USB storage disabled; use the StorageDeviceCTL utility (members of `CIX_MAINTENANCE`) to
+  allow writing temporarily.
+
+## 5. Tools (§4)
+
+| Tool | Use |
+|---|---|
+| IT Security Tool (Start › YOKOGAWA Security) | *Setup* (model + management type), *Save*/*Restore* (with a default password for recreated accounts), *Change Password* of the saved file, *Import*/*Export*, *Information* (summary) |
+| Domain Link Management Tool | Link/unlink the domain (linked domain management); sign in as local admin + `CIX_MAINTENANCE` |
+| `PrepareReconstruction.cmd` then `ciserver-…-ITSecurity.exe` › *Apply IT Security only* | Re-apply with different target components |
+| `Yokogawa.IA.iPCS.Platform.Security.CreateCIXProcess.exe [-p <password>]` (`<DVD>\Windows\CIServer\ITSecurity`) | Create `CIX_PROCESS` or set its password; same password on all collaborating computers; restart |
+| `…CreateCTMProcess.exe [-p <password>]` | Same for `CTM_PROCESS` |
+| `ITSecuritySettingItemExport.exe` | Export applied settings |
+| `YWVNETCreateVNTUser` | Change passwords of the Vnet/IP Interface Package users (VM) |
+
+**Changing the account that runs CI Server (§4.9)**: create the user, add it to
+Administrators (and `RDC_GA_CLIENT` on a dual-redundant platform; `CIX_OPC` or
+`CIX_OPC_LCL` when IT security is applied), set it on the *CI Service* Log On tab and on the
+Identity tab of *CI OPC AE Server* and *CI OPC DA Server* in Component Services › DCOM Config.
+
+## 6. Optional hardening (§5)
+
+Extra settings the site may add: audit policies and event log sizes, disable recovery
+console and Guest account, restrict audit log and removable media access, immediate
+screen-saver password, SNMP, SSL/TLS registry settings, secure startup and
+`AllowedPaths` registry keys, remove *Everyone* for anonymous users, remove unused
+protocols, block malicious DLL loading.

knowledge/manuals/IM36K10G10-01EN.md

@@ -0,0 +1,108 @@
+---
+manual: IM 36K10G10-01EN
+title: CI Server Tutorial
+edition: 3rd Edition, Sep. 2023
+version: R1.03
+status: from docs; item, sub-item, blocking, trigger group, class and object steps verified with dssqld/itmval on CI-Eng-Sample (2026-09-30)
+---
+
+# CI Server Tutorial (R1.03)
+
+A guided tour of the main engineering tasks in the Engineering Module and Edit Module. Each
+chapter points to the full manual for its area; the table shows where this repo covers it.
+
+| Chapter | Topic | Covered in detail by |
+|---|---|---|
+| 1 | Engineering Module window: menu, configuration tree, work area (properties sheets), message area, edit history (undo/redo) | IM 36K10C10 (phase 5) |
+| 2 | Authorization groups and users | IM 36K10C10 (phase 5) |
+| 3 | Sections, items, sub-items, blocking, value updates, item statuses | IM 36K10C10, L35/L36 (phase 5) |
+| 4 | Displays in the Edit Module; HTML displays | IM 36K10C50, R30 (phase 10) |
+| 5 | Trigger groups, classes, objects, symbols linked to objects | IM 36K10L10, P10 (phase 6), C50 (phase 10) |
+| 6 | I/O: lines, stations, scan types, points | IM 36K10L40/L41 (phase 5) |
+| 7 | Item alarms | IM 36K10L15, C20 (phase 8) |
+| 8 | Reports and printers | IM 36K10P20, R40, C30 (phase 11) |
+| 9 | Audit trail | IM 36K10L25 (phase 12) |
+| 10 | RDBMS data exposure (`dbc.sup`) | IM 36K10L45 (phase 7) |
+| 11 | Item search | IM 36K10C10 (phase 5) |
+| 12 | Excel Add-in | IM 36K10E10 (phase 11) |
+| 13 | History: storage groups, units, collection types, aggregation, archiving | IM 36K10L20, C40 (phase 9) |
+
+## Key points
+
+**Users (ch. 2)**: create an authorization group (the set of allowed functions, e.g. `ALL`
+with every function), then a user assigned to it. A user is needed to log on to the Edit
+Module and Operator Interface.
+
+**Items (ch. 3)**
+- Full name `Section.Sub-section.Item` (max 255 bytes; no `:` or `.` inside a name; case
+  insensitive). Sections can be blocked as a whole, e.g. for maintenance.
+- Types: Boolean, Integer, Real, String (max length 80 by default, up to 168 without audit).
+- Four limits (LL, L, H, HH) plus a deadband set the status LOWLOW…HIGHHIGH; the deadband sits
+  on the normal side of each limit. Scale high/low give OVERRANGED / UNDERRANGED.
+  Booleans set status TRUE/FALSE.
+- An item is connected to an I/O point on the *Equipment* tab; the station must exist first.
+- Sub-items: Integrator, Pulse counter, Min-Max, Rate-of-Change (with time unit), Typeless.
+  Sub-items cannot connect to equipment or have sub-items, and are **not** blocked with their
+  main item.
+- Blocked items and offline items are not updated. *Update value* (Engineering Module) or
+  `itmval -p` changes value/status/quality; *Overwrite blocked* (`-o`) is needed for a
+  blocked item. New items are `NOT INIT` until a value is written.
+- Item statuses are system-wide; add your own with numbers **100–127** (1–99 and above 127
+  are reserved), with mnemonic, alarm priority (0–15), alarm state (Normal, Alarm 1–3),
+  colour and shelving.
+
+**Displays (ch. 4)**: a display is built of frames defined by a layout. Edit Module parts:
+sheets, component bar, Visualizations tree, Symbols palette, menus, toolbars, drawing area.
+Display names must be unique and without spaces. *HTML display* mode shows only components
+and properties supported in HTML; switching it off keeps unsupported values.
+
+**Classes and objects (ch. 5)**
+- Trigger group: e.g. `ONE_SECOND`, a permanent 1-second trigger. A class can also be
+  triggered by item changes.
+- Class (traditional language): `CLASS <name>; PROLOG … SIGNAL <var> := "<item>"; BODY
+  METHOD <m>; BODY … ENDMETHOD <m>; ENDCLASS <name>;`. After *Compile*, check the *Listing* tab
+  for errors. `ATTRIBUTE` and `PROMPT` lines define values asked when an object is created.
+- Object: created in a section, from a class, with values for the prompted attributes.
+- Symbol linked to a class (*PROCESS Service class*); on a display set the symbol's `object`
+  property to the object. Properties are linked to items/signals on the *Connection* sheet,
+  with a transformation (e.g. *Linear*); buttons use *Update item/parameter* actions.
+- Test in the Operator Interface by typing the display name in the title bar.
+
+**I/O (ch. 6)**: define in order **line → station → (scan type) → point**, then connect items
+to points. Example: Modbus `LINE1` / `STATION1` / scan type `FAST` / `POINT1`.
+
+**Alarms (ch. 7)**: current, historical and shelved alarm overviews. Item status → alarm
+state (Normal, Alarm 1–3) system-wide, or per item (overrides). Acknowledgement types are
+matrices of state transitions (automatic/manual). Delay time, repeat time (after delay),
+first-out groups, collection groups, alarm selection areas (ASA, filter expressions), areas
+of interest (AOI), notification by e-mail/SMS (users with schedules, destinations tied to an
+ASA).
+
+**Reports (ch. 8)**: defined with a name, destination, RQL query and layout; generated ad hoc,
+on a schedule, or on an item event (with delay). Destinations: `DEFAULT`, `PRINTER_1`,
+`NONE` (keep on disk), `ALARMS`, `AUDIT_TRAIL`, `MESSAGES`, `SCREEN_CAPTURE`; only `DEFAULT` and
+`PRINTER_1` print by default. Destinations use primary/secondary devices with a policy
+(automatic, both, none).
+
+**Audit trail (ch. 9)**: stored in dataset `AUDIT_TRAIL`, storage group `ADT`; events are
+named `<subject group>.<attribute>.<action>.<source>`, e.g. `ITEM.VALUE.MODIFY.HMI`; records
+cannot be deleted except by deleting storage units.
+
+**RDBMS exposure (ch. 10)**: copies CI Server data (`ITEM_VALUES` aggregated per interval,
+`ITEM_HISTORY` with a mandatory filter, `ITEM_INPUTS` for writes back, or any dataset on
+change) into SQL tables. Configure the connection string or system DSN in `dbc.sup`; with
+Windows authentication add `CIX_PROCESS` to SQL Server (db_owner).
+
+**Other**: Item search (wildcards, copy/drag to Excel or Trend); Excel Add-in reports;
+history storage groups and archiving (phase 9).
+
+## Verified on CI-Eng-Sample (command-line equivalents)
+
+| Tutorial step | Done with | Result |
+|---|---|---|
+| Sections and items (3.2) | `dssqld -i` `SECTION_DF`, `ITEM_DF` | loaded |
+| Sub-items (3.2.3) | `SUB_ITEM_DF` | Min-Max keeps the maximum; **Integrator adds value × seconds; `TIME_UNIT` has no effect** |
+| Block item (3.3) | `dssqld -m` `ITEM_DF` `BLOCKED` 1/0 | option flag `blk` (status stays 9); writes without `-o` are **silently ignored**; after unblocking the flag `ublk` appears |
+| Trigger group (5.1) | `TRIGGER_DF` (`TRIGGER_INTERVAL` "1 seconds") | loaded |
+| Class (5.2) | `CLASS_DF` with `METHOD` memo and `COMPILE` 1 | compiled on load |
+| Object (5.3) | `OBJECT_DF` (`NAME`, `CLASS`) | runs: `DEMO.COUNTER` counts 1…100 every second |

knowledge/progress.md

@@ -31,9 +31,9 @@ AID is not needed.
 |---|---|---|---|
 | 0 | IM 36K01A50 | Release Information | summarized ([notes](manuals/IM36K01A50-01EN.md)) |
 | 1 | IM 36K10J10 | System Design/Management | done except migration (phase 6) and debugging tools; skill `system-management` ([notes](manuals/IM36K10J10-01EN.md)) |
-| 2 | IM 36K01C10 | CI Server Setup | not started |
+| 2 | IM 36K01C10 | CI Server Setup | summarized ([notes](manuals/IM36K01C10-01EN.md)); skill `installation-security` |
-| 2 | IM 36K01C30 | Security Guide | not started |
+| 2 | IM 36K01C30 | Security Guide | summarized ([notes](manuals/IM36K01C30-01EN.md)); skill `installation-security` |
-| 3 | IM 36K10G10 | Tutorial | not started |
+| 3 | IM 36K10G10 | Tutorial | summarized ([notes](manuals/IM36K10G10-01EN.md)); command-line equivalents practiced on CI-Eng-Sample |
 | 4 | IM 36K10R10 | CI Portal Setup | not started |
 | 4 | IM 36K10R20 | Setup File Editor | not started |
 | 5 | IM 36K10C10 | Engineering Module - I/O Processes | not started |
@@ -90,3 +90,16 @@ now come before classes and objects (phase 6), and the other interfaces follow a
 | J10 | Backup of `tls` folders | not practiced | n/a | Plan only; the actual backup tool is site-specific. |
 | J10 | Migration between systems (§5.6) | not practiced | pending | Needs engineered data; revisit after phase 6. |
 | J10 | Tuning checks (read-only) ([task](../.claude/skills/system-management/tasks/tuning-checks.md)) | passed | n/a | Read `dur.sup` (max processes 250), `itm.sup` (item pool 650,000 KB) and the automatic health snapshots `tls\log\smd_*.log` (common memory free, queue use per process, lock collisions). Debug launchers and interactive debuggers not practiced. |
+| C10/C30 | Setup check script `tools/setup_check.ps1` ([task](../.claude/skills/installation-security/tasks/setup-check.md)) | passed | n/a | Read-only; 16 OK / 5 CHECK / 15 DIFF on the Win10 Pro test PC (kept as dev PC by decision). |
+| C10 | Read `ci_start.log` and web ports (`jwuiisg.sup`) | passed | n/a | All services started; SSL error [ISS-008](issues.md). |
+| C10 | Start / stop CI Server | passed (phase 1) | n/a | Via the CI Service (elevated). Start-menu shortcuts not used. |
+| C10 | New install, reinstall, upgrade, uninstall, licence | not practiced | n/a | Would reinstall or change the test system; only the installed R1.03 is available. Skipped. |
+| C10 | Windows settings changes (power, virtual memory, Defender, updates, …) | not practiced | n/a | Test PC kept as a development PC (user decision 2026-09-30); not applied. |
+| C10 | Vnet/IP drivers / Vnet/IP Interface Package | not practiced | n/a | No Vnet/IP card; not supported on Windows 10 Pro. |
+| C30 | IT Security Tool, Domain Link Management, account utilities | not practiced | n/a | Not installed and not supported on Windows 10 Pro. |
+| G10 | Sub-items: Integrator, Min-Max (`SUB_ITEM_DF`) ([task](../.claude/skills/item-engineering/tasks/sub-items.md)) | passed | passed | Integrator adds value × seconds; `TIME_UNIT` ignored. |
+| G10 | Block / unblock an item (`ITEM_DF.BLOCKED` via `dssqld -m`); write with `itmval -o` ([task](../.claude/skills/item-engineering/tasks/block-item.md)) | passed | passed | `blk` flag, writes without `-o` silently ignored; `ublk` after unblock ([ISS-001](issues.md)). |
+| G10 | Trigger group, class (compile on load), object via quick load ([task](../.claude/skills/class-object-engineering/tasks/load-class-object.md)) | passed | passed | `DEMO.COUNTER` counts every second; full remove/load cycle clean. |
+| G10 | Authorization group and user creation | not practiced | n/a | Creates CI Server login accounts; left for the user or phase 5. |
+| G10 | Displays, symbols, Operator Interface test | not practiced | pending | GUI (Edit Module); phase 10. |
+| G10 | Lines / stations / points, alarms, reports, audit, RDBMS, history | not practiced | pending | Covered in their own phases (5–12). |

tools/README.md

@@ -3,3 +3,7 @@
 Helper scripts Claude can run. Scripts that read the manuals must not hard-code their
 location; take it from an argument or environment variable, with
 `C:\Users\Public\Yokogawa\tls\doc\EN\` as the default.
+
+| Script | Purpose |
+|---|---|
+| `setup_check.ps1` | Read-only check of a machine against the CI Server R1.03 setup and security requirements (skill `installation-security`) |

tools/setup_check.ps1

@@ -0,0 +1,129 @@
+# CI Server R1.03 - read-only setup check
+# Compares a machine with the Windows settings required by CI Server Setup (IM 36K01C10-01EN §2.1.2)
+# and the IT security state described in the Security Guide (IM 36K01C30-01EN §2.2, §3.2).
+# Changes nothing. Run in Windows PowerShell 5.1; some checks need an elevated session.
+# Usage: powershell -NoProfile -ExecutionPolicy Bypass -File tools\setup_check.ps1
+
+$results = New-Object System.Collections.Generic.List[object]
+function Add-Result($area, $check, $expected, $actual, $ok) {
+    $status = 'CHECK'
+    if ($ok -eq $true) { $status = 'OK' } elseif ($ok -eq $false) { $status = 'DIFF' }
+    $results.Add([pscustomobject]@{ Status = $status; Area = $area; Check = $check; Expected = $expected; Actual = "$actual" })
+}
+function Get-Reg($path, $name) {
+    try { (Get-ItemProperty -Path $path -Name $name -ErrorAction Stop).$name } catch { $null }
+}
+
+# --- CI Server ---------------------------------------------------------------
+$ci = $null
+foreach ($k in 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*', 'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*') {
+    foreach ($i in (Get-ItemProperty $k -ErrorAction SilentlyContinue)) { if ($i.DisplayName -like 'CI Server R*') { $ci = $i } }
+}
+if ($ci) { Add-Result 'CI Server' 'Installed version' '1.03.00' $ci.DisplayVersion ($ci.DisplayVersion -eq '1.03.00') }
+else { Add-Result 'CI Server' 'Installed version' '1.03.00' 'not found' $false }
+$svc = Get-Service StartCIServer -ErrorAction SilentlyContinue
+if ($svc) {
+    Add-Result 'CI Server' 'CI Service state' 'Running (when in use)' $svc.Status $null
+    Add-Result 'CI Server' 'CI Service startup type' 'Automatic in operation; Manual during upgrade' $svc.StartType $null
+    $acct = (Get-CimInstance Win32_Service -Filter "Name='StartCIServer'" -ErrorAction SilentlyContinue).StartName
+    Add-Result 'CI Server' 'CI Service account' '.\CIX_PROCESS (default)' $acct ($acct -like '*CIX_PROCESS')
+}
+$vagw = Get-Service | Where-Object { $_.DisplayName -like 'VAGW*' }
+Add-Result 'CI Server' 'VAGW Bossd service' 'present only if installed with IT Security Tool' ($(if ($vagw) { ($vagw | ForEach-Object { "$($_.DisplayName)=$($_.Status)" }) -join ', ' } else { 'not installed' })) $null
+
+# --- Operating system --------------------------------------------------------
+$os = Get-CimInstance Win32_OperatingSystem
+$supported = @('Windows 10 Pro', 'Windows 10 Enterprise', 'Windows 10 IoT Enterprise', 'Windows Server 2016', 'Windows Server 2019', 'Windows Server IoT 2019')
+$osOk = $false; foreach ($s in $supported) { if ($os.Caption -like "*$s*") { $osOk = $true } }
+Add-Result 'Windows' 'Operating system' 'Win10 Pro/Enterprise/IoT LTSB 2016/LTSC 2019, Server 2016/2019' "$($os.Caption) build $($os.BuildNumber)" $osOk
+if ($os.Caption -like '*Windows 10 Pro*') { Add-Result 'Windows' 'Windows 10 Pro note' 'Vnet/IP drivers and IT Security Tool not supported on Win10 Pro' 'Windows 10 Pro' $null }
+
+# Visual effects: "Let Windows choose" = VisualFXSetting 0
+$vfx = Get-Reg 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\VisualEffects' 'VisualFXSetting'
+Add-Result 'Windows' 'Visual effects' "Let Windows choose (0)" $(if ($null -eq $vfx) { 'not set (default = Let Windows choose)' } else { $vfx }) ($null -eq $vfx -or $vfx -eq 0)
+
+# Virtual memory: custom size = 1.5 x RAM, not automatic
+$ramMB = [math]::Round((Get-CimInstance Win32_ComputerSystem).TotalPhysicalMemory / 1MB)
+$auto = (Get-CimInstance Win32_ComputerSystem).AutomaticManagedPagefile
+$pf = Get-CimInstance Win32_PageFileSetting -ErrorAction SilentlyContinue
+$pfText = if ($pf) { ($pf | ForEach-Object { "$($_.Name) $($_.InitialSize)-$($_.MaximumSize) MB" }) -join '; ' } else { 'system managed' }
+$want = [math]::Round($ramMB * 1.5)
+$pfOk = (-not $auto) -and $pf -and (($pf | Where-Object { $_.InitialSize -ge $want * 0.95 -and $_.MaximumSize -ge $want * 0.95 }) -ne $null)
+Add-Result 'Windows' 'Virtual memory' "custom, initial = max = ~$want MB (1.5 x $ramMB MB RAM)" "automatic=$auto; $pfText" $pfOk
+
+# Processor scheduling: Programs = Win32PrioritySeparation 0x26 (38) or 2
+$prio = Get-Reg 'HKLM:\SYSTEM\CurrentControlSet\Control\PriorityControl' 'Win32PrioritySeparation'
+Add-Result 'Windows' 'Processor scheduling' 'Programs (38 or 2)' $prio ($prio -eq 38 -or $prio -eq 2)
+
+# Power plan
+$plan = (powercfg /getactivescheme) 2>$null
+Add-Result 'Windows' 'Power plan' 'High performance; never sleep/hibernate, disk and display never off' $plan ($plan -match 'High performance')
+
+# Fast startup
+$hib = Get-Reg 'HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Power' 'HiberbootEnabled'
+Add-Result 'Windows' 'Fast startup (HiberbootEnabled)' '0' $hib ($hib -eq 0)
+
+# Windows Defender
+$defPol = Get-Reg 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender' 'DisableAntiSpyware'
+$defSvc = Get-Service WinDefend -ErrorAction SilentlyContinue
+Add-Result 'Windows' 'Windows Defender' 'turned off by policy (use Yokogawa-approved antivirus)' "policy DisableAntiSpyware=$defPol; service=$(if ($defSvc) { $defSvc.Status } else { 'none' })" ($defPol -eq 1)
+
+# Automatic Windows updates
+$au = Get-Reg 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU' 'NoAutoUpdate'
+Add-Result 'Windows' 'Automatic Windows updates' 'Disabled by policy (NoAutoUpdate=1)' $au ($au -eq 1)
+
+# Scheduled drive optimization and component cleanup
+foreach ($t in @(@('\Microsoft\Windows\Defrag\', 'ScheduledDefrag', 'Automatic drive optimization'), @('\Microsoft\Windows\Servicing\', 'StartComponentCleanup', 'Automatic cleanup'))) {
+    $task = Get-ScheduledTask -TaskPath $t[0] -TaskName $t[1] -ErrorAction SilentlyContinue
+    Add-Result 'Windows' $t[2] 'Disabled' $(if ($task) { $task.State } else { 'task not found' }) ($task -and $task.State -eq 'Disabled')
+}
+
+# .NET Framework 3.5
+$net35 = Get-Reg 'HKLM:\SOFTWARE\Microsoft\NET Framework Setup\NDP\v3.5' 'Install'
+Add-Result 'Windows' '.NET Framework 3.5' 'installed' $(if ($net35 -eq 1) { 'installed' } else { 'not installed' }) ($net35 -eq 1)
+
+# DCOM default authentication level: Connect = 2
+$dcom = Get-Reg 'HKLM:\SOFTWARE\Microsoft\Ole' 'LegacyAuthenticationLevel'
+Add-Result 'Windows' 'DCOM Default Authentication Level' 'Connect (2)' $(if ($null -eq $dcom) { 'not set (default = Connect)' } else { $dcom }) ($null -eq $dcom -or $dcom -eq 2)
+
+# Display scale 100 %
+$dpi = Get-Reg 'HKCU:\Control Panel\Desktop\WindowMetrics' 'AppliedDPI'
+Add-Result 'Windows' 'Display scale' '100 % (96 DPI)' $(if ($null -eq $dpi) { 'unknown' } else { "$dpi DPI" }) ($dpi -eq 96)
+
+# 8dot3 file naming
+$d83 = (fsutil behavior query disable8dot3) 2>$null | Select-Object -First 1
+Add-Result 'Windows' '8dot3 file naming' 'state 2 (per volume) or 0 (enabled)' $d83 ($d83 -match 'is:\s*[02]\b|\b[02] \(')
+
+# Regional settings (must not change after IT security is applied)
+Add-Result 'Windows' 'Regional format / UI language' 'set before applying IT security; do not change afterwards' "$((Get-Culture).Name) / $((Get-UICulture).Name)" $null
+
+# --- IT security (Security Guide) --------------------------------------------
+$groups = 'CIX_OPERATOR', 'CIX_ENGINEER', 'CIX_MAINTENANCE', 'CIX_OPC'
+foreach ($g in $groups) {
+    $lg = Get-LocalGroup -Name $g -ErrorAction SilentlyContinue
+    Add-Result 'IT security' "Local group $g" 'exists after IT Security Tool (standalone)' $(if ($lg) { 'exists' } else { 'missing' }) ([bool]$lg)
+}
+foreach ($u in 'CIX_PROCESS', 'CTM_PROCESS') {
+    $lu = Get-LocalUser -Name $u -ErrorAction SilentlyContinue
+    Add-Result 'IT security' "Local user $u" 'exists' $(if ($lu) { "exists, enabled=$($lu.Enabled)" } else { 'missing' }) ([bool]$lu)
+}
+$itsec = Test-Path 'C:\Program Files (x86)\YOKOGAWA\IA\iPCS\Platform\Security'
+Add-Result 'IT security' 'IT Security Tool installed' 'yes, when installed with ciserver-...-ITSecurity.exe' $(if ($itsec) { 'yes' } else { 'no' }) $itsec
+
+foreach ($p in (Get-NetFirewallProfile -ErrorAction SilentlyContinue)) {
+    Add-Result 'Firewall' "Profile $($p.Name)" 'Enabled' $p.Enabled ($p.Enabled -eq $true)
+}
+$ports = @{ 'TCP 8080' = 8080; 'TCP 8443' = 8443; 'UDP 17001' = 17001; 'UDP 17101' = 17101; 'UDP 18002' = 18002 }
+$allow = Get-NetFirewallRule -Direction Inbound -Action Allow -Enabled True -ErrorAction SilentlyContinue | Get-NetFirewallPortFilter -ErrorAction SilentlyContinue
+foreach ($name in $ports.Keys) {
+    $proto, $num = $name.Split(' ')
+    $hit = $allow | Where-Object { $_.Protocol -eq $proto -and ($_.LocalPort -contains "$num" -or $_.LocalPort -contains 'Any') }
+    Add-Result 'Firewall' "Inbound $name allowed" 'yes (web / secure web / DURM / SMDMON)' $(if ($hit) { 'yes' } else { 'no rule found' }) ([bool]$hit)
+}
+
+# --- Output --------------------------------------------------------------------
+foreach ($r in ($results | Sort-Object Area, Check)) {
+    "[{0,-5}] {1} / {2}: {3}   (expected: {4})" -f $r.Status, $r.Area, $r.Check, $r.Actual, $r.Expected
+}
+$sum = $results | Group-Object Status | ForEach-Object { "$($_.Name)=$($_.Count)" }
+"Summary: $($sum -join ', ')   (OK = matches, DIFF = differs, CHECK = review manually)"