WHEN→DO rule template

Trigger: port state change or schedule. Condition: DEVIATION/ALARM norm. Action: relay / notify / webhook. Always check the “why it fired” journal.