R1.05 verification V1-V3 done; fix setup_check firewall rule match

V1 eqpdbg main info and V2 setup_check.ps1 run read-only on the R1.05
test server (temporary copy deleted). setup_check.ps1 counted
program-limited 'any port' rules (e.g. Remote Desktop Shadow) as allowing
the CI Server ports; now only port rules or any-port rules without a
program limit count. V3 checked in the installed form definitions.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.claude/skills/data-access/tasks/opcua-client.md

@@ -2,7 +2,7 @@
 task: OPC UA client to an OPC UA server by quick load (loopback to CI Server's own OPC UA server)
 version: R1.05 (first written for R1.03)
 source: IM 36K10L45-01EN 5th ed. (Feb. 2026) §10, §11; IM 36K10E20-01EN 4th ed. (Feb. 2026) §2; practiced on CI-Eng-Sample 2026-10-01 on R1.03 (station CIENG_UA; full remove/reload; point also configured in the Engineering Module by the user and compared)
-status: verified on R1.03 (§1–§6). R1.05 (2026-10-08, read-only): line/station/subscription/point dataset definitions identical to R1.03, PKI folders and client setup files checked; the loopback itself awaits the user's decision to load CI-Eng-Sample on the shared R1.05 test server (V4), the new form fields await user verification (V3; knowledge/r105-verification.md). §7 (methods) from docs.
+status: verified on R1.03 (§1–§6). R1.05 (2026-10-08, read-only): line/station/subscription/point dataset definitions identical to R1.03, PKI folders and client setup files checked; the loopback itself awaits the user's decision to load CI-Eng-Sample on the shared R1.05 test server (V4), the new form fields were confirmed in the installed form definitions (point form `READ_NODE_INFO` / `REBROWSE`; method form node ID type, parent object node ID, manual arguments, no process-area field), the forms themselves not opened. §7 (methods) from docs.
 ---
 
 # OPC UA client to an OPC UA server

.claude/skills/installation-security/tasks/setup-check.md

@@ -74,8 +74,10 @@ Windows 10 LTSC 2021 or Windows 11 LTSC 2024. The script reports `[CHECK]` for t
 
 ## R1.05 test server result (2026-10-08)
 
-Checks run one by one, read-only. The script itself is **awaiting user verification** (V2 in
+Checks run one by one, read-only, then the script itself (copied to a temporary folder,
-`knowledge/r105-verification.md`). Windows Server 2025
+run from an elevated session, deleted again): **12 OK, 5 CHECK, 20 DIFF**. The first run
+showed the CI Server ports as allowed: the script counted program-limited Windows rules with
+"any port" (e.g. Remote Desktop Shadow) as a match. Fixed 2026-10-08; such rules no longer count. Windows Server 2025
 Datacenter (24H2) virtual machine, domain member, CI Server R1.05.00 (r11609M) installed in
 `C:\Yokogawa\CIServer` without the IT Security Tool.
 
@@ -93,6 +95,8 @@ Datacenter (24H2) virtual machine, domain member, CI Server R1.05.00 (r11609M) i
 ## R1.03 test system result (2026-09-30)
 
 Windows 10 Pro 19045 development PC without the IT Security Tool: 16 OK, 5 CHECK, 15 DIFF.
+(Run before the firewall-check fix of 2026-10-08, so "inbound allowed" lines may have counted
+program-limited "any port" rules; re-run to confirm.)
 Differences: firewall domain/private profiles off; no `CIX_` groups or `CTM_PROCESS` (IT
 Security Tool not installed; not supported on Windows 10 Pro); fast startup on; Balanced power
 plan; automatic virtual memory; Defender on; automatic updates, defrag and cleanup not

knowledge/manuals/IM36K10L40-01EN.md

@@ -3,7 +3,7 @@ manual: IM 36K10L40-01EN
 title: EQUIPMENT Service Engineering - Utilities
 edition: 4th Edition, Feb. 2026 (R1.05); content unchanged since the 3rd Edition, Sep. 2023 (R1.03): the revision table lists contact information only
 version: R1.05 (first written for R1.03)
-status: from docs; installed programs, setup file and start scripts checked, eqpdbg "Get main info" run read-only on the R1.03 test system (2026-09-30); on the R1.05 test server files and tool menus checked read-only (2026-10-08); eqpdbg "Get main info" on R1.05 awaiting user verification (V1 in knowledge/r105-verification.md); EQT tools not tested (no EQT line)
+status: from docs; installed programs, setup file and start scripts checked, eqpdbg "Get main info" run read-only on the R1.03 test system (2026-09-30); on the R1.05 test server files and tool menus checked read-only (2026-10-08); eqpdbg "Get main info" run read-only on R1.05 too (2026-10-08); EQT tools not tested (no EQT line)
 ---
 
 # EQUIPMENT Service Engineering - Utilities (R1.05)
@@ -89,6 +89,8 @@ printf '1\n-1\n' | eqpdbg 0 EQPMDC
 
 Test system: `eqpdbg 0 EQPMDC` main info showed line type 107, both lines attached, 100 ms
 scan interval, 2 slaves, 2 % line load.
+R1.05 test server (2026-10-08): same tool, prompts and output layout: line type 107, lines 0 and 1
+attached, 100 ms, ON_SCAN, 1 slave, criterion mask 0x000D, 0 % line load; `-1` exits.
 
 **`eqtdbg`** (R1.04 and later) is the same debugger for EQT managers: default process `EQT`,
 same action numbers −2…23 (menu strings read from both programs on R1.05, 2026-10-08; not

knowledge/progress.md

@@ -49,9 +49,9 @@ screenshot.
 | Skill / area | Manual changes after R1.03 | R1.05 status | Notes |
 |---|---|---|---|
 | `system-check` | — | re-checked (read-only) | Version, paths, service, node, time on the R1.05 test server 2026-10-08. Start/stop not repeated (shared server). |
-| `installation-security` | C10, C30 (large: IT security 3.0, LAPS, upgrade merge `jupgutl`, PRM) | re-checked (read-only) | 2026-10-08: skill, summaries and `tools/setup_check.ps1` updated to R1.05. Setup check run by hand on the R1.05 test server. **Awaiting user verification:** the script itself (V2). **Not tested:** IT security 2.0/3.0, LAPS, Vnet/IP, upgrade merge, PRM (not available there). ISS-086–090. |
+| `installation-security` | C10, C30 (large: IT security 3.0, LAPS, upgrade merge `jupgutl`, PRM) | re-checked (read-only) | 2026-10-08: skill, summaries and `tools/setup_check.ps1` updated to R1.05. Setup check run by hand on the R1.05 test server. Script run there too (12 OK, 5 CHECK, 20 DIFF; firewall check fixed). **Not tested:** IT security 2.0/3.0, LAPS, Vnet/IP, upgrade merge, PRM (not available there). ISS-086–090. |
-| `data-access` | L45, E20 (large: REST API, OPC UA methods, information model mapper, certificate expiry, extended functions off by default), L50 dataset rename | re-checked (read-only) | 2026-10-08: skill and summaries updated, L45 section numbers remapped. Setup files, datasets, ports and certificates checked; Sample qli files unchanged. **Awaiting user verification:** Engineering Module forms (V3); OPC UA loopback needs the sample loaded (V4, decision). **Not tested:** OPC A&E direct alarms, PubSub, imported information model. ISS-080–085. |
+| `data-access` | L45, E20 (large: REST API, OPC UA methods, information model mapper, certificate expiry, extended functions off by default), L50 dataset rename | re-checked (read-only) | 2026-10-08: skill and summaries updated, L45 section numbers remapped. Setup files, datasets, ports and certificates checked; Sample qli files unchanged. New form fields confirmed in the installed form definitions (V3); OPC UA loopback needs the sample loaded (V4, decision). **Not tested:** OPC A&E direct alarms, PubSub, imported information model. ISS-080–085. |
-| `equipment` | L41 (IEC 61850, item status, App. 1); IEC 104/61850 drivers moved to `eqt`/`eta` | re-checked (read-only) | 2026-10-08: Modbus datasets, setup files and tools identical to R1.03; EQT family, IEC 61850 report control blocks and upgrade steps added. Sample qli files unchanged. **Awaiting user verification:** `eqpdbg` main info (V1); Modbus station re-test needs the sample loaded (V4, decision). **Not tested:** IEC 104 / IEC 61850 and the EQT tools (no device). ISS-076–079. |
+| `equipment` | L41 (IEC 61850, item status, App. 1); IEC 104/61850 drivers moved to `eqt`/`eta` | re-checked (read-only) | 2026-10-08: Modbus datasets, setup files and tools identical to R1.03; EQT family, IEC 61850 report control blocks and upgrade steps added. Sample qli files unchanged. `eqpdbg` main info run on R1.05 (V1); Modbus station re-test needs the sample loaded (V4, decision). **Not tested:** IEC 104 / IEC 61850 and the EQT tools (no device). ISS-076–079. |
 | pyTOOLS (new) | P40 new | not started | No skill yet. |
 | `graphics` | C50, C60, R30 (small) | manual diff read | |
 | `history-management` | C40 §4.2 (REST API, pyTOOLS) | manual diff read | The REST API itself is described in skill `data-access` (L45 ch. 4); link to it from here. |

knowledge/r105-verification.md

@@ -26,7 +26,9 @@ Close every form with *Cancel*.
 
 ## Awaiting user verification
 
-### V1. `eqpdbg` main info (skill `equipment`, L40 summary §3)
+### V1. `eqpdbg` main info (skill `equipment`, L40 summary §3): **done 2026-10-08**
+
+Run by Claude over ssh at the user's request; output as expected (recorded in the L40 summary).
 
 On the R1.05 test server, in a normal command prompt:
 
@@ -38,7 +40,10 @@ Type `1` (Get main info), Enter, read the output, then `-1` (Exit). Expected: li
 the Modbus line(s) attached, scan interval (tick) in ms, number of slaves, line load %.
 Do not choose any other action number. Send a screenshot of the output.
 
-### V2. Setup check script (skill `installation-security`, task `setup-check.md`)
+### V2. Setup check script (skill `installation-security`, task `setup-check.md`): **done 2026-10-08**
+
+Run by Claude (temporary copy, deleted afterwards): 12 OK, 5 CHECK, 20 DIFF after fixing the
+firewall check (see `setup-check.md`).
 
 Copy `tools/setup_check.ps1` from this repo to a scratch folder on the server, run it in an
 **elevated** Windows PowerShell, then delete the copy:
@@ -52,7 +57,14 @@ Datacenter shown as not in the list; DIFF for firewall domain profile, Defender,
 updates, defrag / component cleanup, page file, .NET 3.5, missing `CIX_` groups; CHECK lines
 for IT security. Send the result table (screenshot or text).
 
-### V3. Engineering Module forms (skill `data-access`)
+### V3. Engineering Module forms (skill `data-access`): **form definitions checked 2026-10-08**
+
+Claude has no GUI access to the server. Checked instead in the installed form definitions
+(`tls\wap\cfg`): the main menu has the *OPC UA Information Model Mapper* action (dataset
+`UASERVER_MAPPER_DF`); each user in the project tree has *Add API key* (dataset `API_KEYS_DF`);
+the OPC UA client point form has `READ_NODE_INFO` and `REBROWSE`; the method form has node ID
+type, parent object node ID, manual argument fields and no process-area field. Screenshots of
+the open forms are optional.
 
 In the Engineering Module on the server (log on as a user with engineering rights), open each
 form below, take a screenshot, and close it with *Cancel*:

tools/setup_check.ps1

@@ -153,10 +153,16 @@ foreach ($p in (Get-NetFirewallProfile -ErrorAction SilentlyContinue)) {
 $ports = @{ 'TCP 8080' = 8080; 'TCP 8443' = 8443; 'UDP 17001' = 17001; 'UDP 17101' = 17101; 'UDP 18002' = 18002 }
 # R1.05: RESTful API web server (jrstsrv.sup JRST_NETWORK_PORT), IM 36K01C30-01EN 5th ed. Table 3.2-1
 if (-not $isR103) { $ports['TCP 34597'] = 34597 }
-$allow = Get-NetFirewallRule -Direction Inbound -Action Allow -Enabled True -ErrorAction SilentlyContinue | Get-NetFirewallPortFilter -ErrorAction SilentlyContinue
+# A rule counts when it names the port, or allows any port without being limited to one program
+# (Windows' own "any port" rules such as Remote Desktop Shadow are program-limited and do not count).
+$allow = foreach ($r in (Get-NetFirewallRule -Direction Inbound -Action Allow -Enabled True -ErrorAction SilentlyContinue)) {
+    $pf = $r | Get-NetFirewallPortFilter -ErrorAction SilentlyContinue
+    $af = $r | Get-NetFirewallApplicationFilter -ErrorAction SilentlyContinue
+    [pscustomobject]@{ Protocol = $pf.Protocol; LocalPort = @($pf.LocalPort); AnyProgram = ($af.Program -eq 'Any' -and $af.Package -in @($null, '', 'Any')) }
+}
 foreach ($name in $ports.Keys) {
     $proto, $num = $name.Split(' ')
-    $hit = $allow | Where-Object { $_.Protocol -eq $proto -and ($_.LocalPort -contains "$num" -or $_.LocalPort -contains 'Any') }
+    $hit = $allow | Where-Object { $_.Protocol -eq $proto -and ($_.LocalPort -contains "$num" -or ($_.LocalPort -contains 'Any' -and $_.AnyProgram)) }
     Add-Result 'Firewall' "Inbound $name allowed" 'yes (web / secure web / DURM / SMDMON / RESTful API)' $(if ($hit) { 'yes' } else { 'no rule found' }) ([bool]$hit)
 }