# R1.05 verification checklist

Two kinds of R1.05 checks are open after the read-only re-check of 2026-10-08:

- **Not tested:** the function is not available on the R1.05 test server, so it cannot be
  tested there at all. The content stays "from docs" and is marked **not tested** with the
  reason. Nothing to do until a suitable system exists.
- **Awaiting user verification:** Claude could not run the step itself (refused as a remote
  command, needs an administrator, needs the GUI). Claude prepared the steps and expected
  results below; the user runs them on the server or in the GUI and sends the output or a
  screenshot, and Claude records the result in the task file and in `progress.md`.

All steps below are read-only: they open forms or print information and save nothing.
Close every form with *Cancel*.

## Not tested on the R1.05 test server

| Area | Reason | Where marked |
|---|---|---|
| IT Security Tool (version 2.0 / 3.0), `CIX_` groups, `CTM_PROCESS`, LAPS, GPO import | Tool not installed; Windows Server 2025 is not supported by the tool | skill `installation-security`, C10/C30 summaries |
| Vnet/IP drivers, VAGW Bossd | No Vnet/IP card; not supported on Server 2025 | skill `installation-security`, C10 summary |
| Upgrade from R1.03/R1.04 with the automatic configuration merge (`jupgutl`, `-c` argument) | Fresh R1.05 install, no upgrade to observe; an upgrade test needs a separate machine | C10 summary, ISS-086 |
| CI Server with PRM | No PRM | C10 summary, ISS-090 |
| IEC 60870-5-104 and IEC 61850 (EQT managers, report control blocks, `eqtdbg`, `eqtfrcscn`) | No device and no EQT line on the server | skill `equipment`, L40/L41 summaries, ISS-076–079 |
| OPC A&E `OPXAES_DIR_ALM`, OPC UA PubSub, imported information model | Needs another client/server or extra server instances | skill `data-access`, ISS-085 |
| Enterprise operation on the HTML display, RDP Connect, Password Check, custom alarm acknowledgement | No enterprise setup or RDP target; displays must not be changed on the shared server | skill `graphics`, ISS-093, 098, 099 |
| Storage groups, aggregation, `ITEM_HISTORY` reads, archive | A new storage group needs a CI Server restart; no archive device | skill `history-management`, ISS-103 |
| Separate CI Portal node, gateway core, setup-file changes, CSP effect on displays | Single node, no gateway licence, shared server | skills `portal-setup`, `system-management`, ISS-111, 116 |
| Monitoring processes (`int*mon`) | Starting processes on the shared server | skill `system-management` |
| CENTUM VP virtual test, HIS-TSE connection (G10 ch. 14–15) | No CENTUM VP, no `tls\vagw` | G10 summary, ISS-127 |
| HAC: redundant pair, switchover, mirror, history merge, recovery, journaling | Single server, no HAC licence | skill `high-availability`, ISS-160 |
| External alarms (EAL, OPC UA, CENTUM VP), alarm e-mail/SMS, shelving, ASPA GUI | No external system, modem or ASPA use on the shared server | skill `alarm-management`, ISS-134 |
| Audit `PENDING` action | Needs Vnet update policies | skill `audit-trail`, ISS-141 |
| Active Directory, SPNEGO / SSO, upgrade merge of `dssana.sup` | No domain, no upgrade | skill `authorization`, ISS-149, 153 |
| Excel Add-in | No Office on the R1.05 test server | skill `reporting` |
| pyTOOLS (every function) | No Python on the R1.05 test server | skill `pytools`, ISS-178 |

## Awaiting user verification

### V1. `eqpdbg` main info (skill `equipment`, L40 summary §3): **done 2026-10-08**

Run by Claude over ssh at the user's request; output as expected (recorded in the L40 summary).

On the R1.05 test server, in a normal command prompt:

```
eqpdbg 0 EQPMDC
```

Type `1` (Get main info), Enter, read the output, then `-1` (Exit). Expected: line type 107,
the Modbus line(s) attached, scan interval (tick) in ms, number of slaves, line load %.
Do not choose any other action number. Send a screenshot of the output.

### V2. Setup check script (skill `installation-security`, task `setup-check.md`): **done 2026-10-08**

Run by Claude (temporary copy, deleted afterwards): 12 OK, 5 CHECK, 20 DIFF after fixing the
firewall check (see `setup-check.md`).

Copy `tools/setup_check.ps1` from this repo to a scratch folder on the server, run it in an
**elevated** Windows PowerShell, then delete the copy:

```
powershell -NoProfile -ExecutionPolicy Bypass -File setup_check.ps1
```

Expected (from the one-by-one checks of 2026-10-08): CI Server 1.05.00 OK; Windows Server 2025
Datacenter shown as not in the list; DIFF for firewall domain profile, Defender, automatic
updates, defrag / component cleanup, page file, .NET 3.5, missing `CIX_` groups; CHECK lines
for IT security. Send the result table (screenshot or text).

### V3. Engineering Module forms (skill `data-access`): **form definitions checked 2026-10-08**

Claude has no GUI access to the server. Checked instead in the installed form definitions
(`tls\wap\cfg`): the main menu has the *OPC UA Information Model Mapper* action (dataset
`UASERVER_MAPPER_DF`); each user in the project tree has *Add API key* (dataset `API_KEYS_DF`);
the OPC UA client point form has `READ_NODE_INFO` and `REBROWSE`; the method form has node ID
type, parent object node ID, manual argument fields and no process-area field. Screenshots of
the open forms are optional.

In the Engineering Module on the server (log on as a user with engineering rights), open each
form below, take a screenshot, and close it with *Cancel*:

1. *Tools › OPC UA Information Model Mapper*: the mapper window opens (shows *New Mapping*).
2. *Authorisation › Users*, any user: the *Add API Key* function exists (do not create a key).
3. An OPC UA client point form (*New* on an OPC UA station is enough to see it, then
   *Cancel*): the checkbox *Read additional node information* exists.
4. An OPC UA client method form: fields for node ID type, *Options* tab (parent object node ID)
   and *Arguments* tab; no process-area field.

If no OPC UA client line exists on the server, steps 3–4 need one: skip them and say so.

### V5. Graphics files (skill `graphics`; ISS-092, 094, 096, 097): **done 2026-10-09**

Run by Claude over ssh at the user's request (read-only, temp folder removed). Results in `graphics/tasks/deploy-displays.md`, `layouts.md`, `trend.md` and the C60 summary.

Read-only. Copy `C:\Users\Admin\AppData\Local\Temp\claude\C--Claude-ci-server-engineer\…\scratchpad\gfx\collect.ps1`
(kept in Claude's scratchpad; it only lists names and copies factory files) to a temporary folder
on the server, run it, send back the files it writes (`Layouts.readme`, factory layouts,
`jwuiutl.cmd`, `connectrdp.cmd`, `jwuiutl_help.txt`, AOG/symbol/component lists,
mobileoperator file list), then delete the folder. Also search the mobileoperator chart code for
`PEN_COUNT_LIMIT`. Expected: `connectrdp.cmd` present, help as on R1.03, AOG list with
`AOG_OPCUA_Methods` / `AOG_UAC_MethodArg_Call2`.

### V6. History checks (skill `history-management`; ISS-100, 101): **done 2026-10-09**

Run by Claude over ssh at the user's request (read-only). Results in `history-checks.md`.

`hisdbg`, Enter at the node prompt, then `1`, `20`, `6`, `-1` (no other number). Expected: menu −1…22,
system groups of types 21, 6, 1058, 36, 4; clients such as ITH*, ALH, ADTSTO, LGHUMH, RPTMAN.
And `type %TLS_ROOT_PATH%\tls\com\history_start.cmd` (also `history_stop.cmd`, `item_start.cmd`,
`item_stop.cmd`); send the output to compare with R1.03.

### V7. Setup File Editor GUI (skill `portal-setup`; ISS-112, 113)

Start menu *CI Server › Setup File Editor*, save nothing: Status of `jwuiisg.sup` (expected
*Default*); open it: tabs Information, General, Client communication, Enterprise, Tuning,
Compatibility, Mobile Operator, Proxy Service, Security, Access Control; screenshots of General,
Client communication and Access Control; `dur.sup` General tab shows a cleared *Gateway Core*
box. Close with *Cancel*.

### V8. Start-script extension hook (skill `system-management`; ISS-121)

Needs admin and a CI Server restart, so only on a non-shared system or with approval: put
`cieng_integration_start.cmd` (one line starting `intcpumon -n intcpumon`) in `tls\com`,
restart, check `durwfp -p intcpumon -t 0` returns 0, remove the file and restart again.

### V9, V10, V12, V15: done 2026-10-09 on the shared R1.05 test server

Run with the user's approval as one session (`examples/CI-Eng-Sample/shared/test_r105_writes.ps1`):
sample sections, items, sub-items, alarm definitions, classes/objects, item alarm, printer and
reports plus a string test item and a loop report were loaded (0 errors), tested, removed (0
errors). A before/after snapshot of all touched datasets, the `tls\com`, `sup`, `sav`, `lst` and
`pki` folders and the process list was identical after deleting the test's temporary files
(`dss_*.tmp`, three `opc_t*` compile/reset files). Not removable: the test's alarm history
events, audit-trail records and `umhlog.log` lines. All results matched R1.03; details in the task
files.

### V9. Blocking and string writes (skill `item-engineering`; ISS-129): **done 2026-10-09**

Needs a decision: temporary sample items on the shared server, block/unblock with `dssqld -m`,
`itmval -p` with and without `-o`, a 120-character write to a string item of length 100
(expected 99 characters, status 12); remove everything afterwards.

### V10–V17 (batch 3, 2026-10-09)

Exact steps are in the task files named; all need a non-shared R1.05 system or the user's
approval on the shared one, unless marked read-only.

| # | Skill / task | What | Kind |
|---|---|---|---|
| V10 | `alarm-management` `item-alarming.md` §2–5, `alarm-checks.md` §4 | Alarm raise, acknowledge, delay/repeat on a temporary sample item; INFO event (`almdbg` 16) | **done 2026-10-09** |
| V11 | `audit-trail` `configure-audit.md`, `read-audit-trail.md` §1a | ADTLOG with `APPRR`/`APPR`; selection expression on `appr`; custom acknowledgement record | admin / writes, approval |
| V12 | `reporting` `define-reports.md`, `report-checks.md`, `rql-interactive.md` §3 | Generate / print with the sample, item trigger, `rptstp`, SPOOL to CSV | **done 2026-10-09**; ISS-167 / ISS-168 still open (non-shared system) |
| V13 | `authorization` `users-groups.md` | Users/groups load and remove, ISS-072/073 re-test; *Add API Key* GUI (look only) | non-shared system |
| V14 | `class-object-engineering` `opcdbg-checks.md` | `opcdbg 0 4`, Enter, `OPCJEXE`, `1`, `-1` twice, interactively (ISS-157) | **done 2026-10-09**: OPCJEXE never answers (OPCEXE1 does); hung debugger stopped (ISS-157) |
| V15 | `class-object-engineering` `change-reset-class.md` | Change/reset class re-test with the sample (ISS-158) | **done 2026-10-09** |
| V16 | `authorization` `login-methods.md` | Was `MAX_UI_PER_CLIENT` in `dssana.sup` changed by hand on the test server? (ISS-150) | **answered 2026-10-09**: not changed by hand; reference copies R1.01–R1.04 all 5, test server 500 since an editor save on 2026-09-12 (ISS-150) |
| V17 | `pytools` `setup-first-script.md` §5 | Python 3.12 64-bit on a test Core, `import dss`, first read-only script, `PY_DSS_NOT_LOGGED_IN` check (ISS-178) | test Core with Python |

### V4. CI-Eng-Sample on the R1.05 test server: **reduced load tested 2026-10-08**

The user approved a reduced load (no history group, no user `CIENG`, no layouts/displays) that
is removed again afterwards. Scripts: `examples/CI-Eng-Sample/shared/`.

- Load: 0 errors in every step; R1.05 accepts the sample's `@VERSION 1.03.00` files.
- Classes: `DEMO.COUNTER` counts (65 → 68 in 3 s); `TANK1.CALC.VOLUME` = 100 for level 50
  (traditional class); `TANK1.JFLOW.sPerMin` = 2 for inflow 120 (Java class); sub-item
  `TANK1.LEVEL.MAX` follows the level.
- Modbus loopback (mirror started for the test only): setpoint 1234 → readback 1234,
  `PLC1.COMM_OK` = 1; `eqpdbg 0 EQPCIENG` slave info: `CIENG_PLC` ON_SCAN, line GOOD.
- OPC UA loopback: after the two certificate moves done by the user, `UA.COMM_OK` = 1 (status
  5), `UA.SRV_STATE` = 0, `UA.LEVEL_COPY` followed `TANK1.LEVEL` (62.5). While the server still
  rejected the client, the Boolean status item showed 0 with status 4 (ISS-080).
- Remove: 0 errors. Before/after snapshot: all datasets identical (count and name hash), no
  `CIENG*` record left. Left over and cleaned: 34 `dss_*.tmp` files in `tls\lst` (ISS-091),
  `OPXCIENG.log`, the temporary sample copy.
- Certificates: the test's files (client own certificate `<host>_OPXCIENG.der/.pem`, the
  server certificate trusted in the client store, the client certificate trusted in the
  server store) and the `pkiserver\rejected` folder created by the test were deleted with the
  user's approval. `OPCUAC_PKI_CERTIFICATES_DF` went back from 3 to 1 record by itself: the
  dataset follows the certificate files. The server is back in its original state.

## HMI tests with temporary displays (2026-10-09)

With the user's approval: two temporary displays `CIENG_TEST_TREND` and `CIENG_TEST_WEB` were
copied into `DEPLOY\displays`, exported to HTML with `jwuiutl -e HTML`, viewed in the web client
(logged in as an existing password-less user, as the user said), and deleted again; both
display folders were compared before and after (identical). No existing display or
`Layouts.xml` was touched.
- Trend with 2 pens: draws on the web (ISS-096 closed; `graphics/tasks/trend.md`).
- Web browser component: external pages are blocked by the default CSP, same-origin pages load
  (ISS-111; `portal-setup/tasks/check-web-access.md`). Fix verified the same day: the user added
  two `frame-src` `CSP_ENTRY` lines to `jwuiisg.sup` and restarted CI Server; the external test
  page then showed in the display (temporary display deployed again and removed).