set -u
RULE='{FF36EE51-2837-46D8-9AB8-2441D9070633}'
cls() { # label, exit code, output file
  case "$2" in
    0)   if grep -qi 'ACCESSDENIED\|access is denied\|provider load\|not recognized' "$3"; then echo "$1: ACCESS_OR_PROVIDER_ERROR"; else echo "$1: OK"; fi ;;
    124) echo "$1: TIMEOUT_60s — DISTINCT, not unchanged" ;;
    *)   if grep -qi 'no matching\|not find\|NotFound\|ObjectNotFound' "$3"; then echo "$1: RULE_MISSING — DISTINCT, not unchanged"
         elif grep -qi 'denied\|provider' "$3"; then echo "$1: ACCESS_OR_PROVIDER_ERROR — DISTINCT, not unchanged"
         else echo "$1: ERROR exit=$2 — DISTINCT, not unchanged"; fi ;;
  esac
}

echo "=== A. 5470 LISTENER STATE (separate query) ==="
timeout 60 powershell -NoProfile -Command "\$ErrorActionPreference='Stop'; try { \$c = Get-NetTCPConnection -LocalPort 5470 -State Listen -ErrorAction Stop; 'LISTENERS ' + @(\$c).Count } catch [Microsoft.PowerShell.Cmdletization.Cim.CimJobException] { 'LISTENERS 0' } catch { if (\$_.Exception.Message -match 'No matching') { 'LISTENERS 0' } else { throw } }" > /tmp/a.out 2>&1
rc=$?; cat /tmp/a.out; cls "LISTENER_QUERY" "$rc" /tmp/a.out

echo; echo "=== B. THE RULE BY EXACT NAME ==="
timeout 60 powershell -NoProfile -Command "\$ErrorActionPreference='Stop'; \$r = Get-NetFirewallRule -Name '$RULE' -ErrorAction Stop; 'Name=' + \$r.Name; 'Group=' + \$r.Group; 'Enabled=' + \$r.Enabled; 'Direction=' + \$r.Direction; 'Action=' + \$r.Action; 'Profile=' + \$r.Profile" > /tmp/b.out 2>&1
rc=$?; cat /tmp/b.out; cls "RULE_QUERY" "$rc" /tmp/b.out

echo; echo "=== C. PORT FILTER (per-rule) ==="
timeout 60 powershell -NoProfile -Command "\$ErrorActionPreference='Stop'; \$f = Get-NetFirewallRule -Name '$RULE' -ErrorAction Stop | Get-NetFirewallPortFilter -ErrorAction Stop; 'Protocol=' + \$f.Protocol; 'LocalPort=' + \$f.LocalPort" > /tmp/c.out 2>&1
rc=$?; cat /tmp/c.out; cls "PORTFILTER_QUERY" "$rc" /tmp/c.out

echo; echo "=== D. ADDRESS FILTER (per-rule) ==="
timeout 60 powershell -NoProfile -Command "\$ErrorActionPreference='Stop'; \$f = Get-NetFirewallRule -Name '$RULE' -ErrorAction Stop | Get-NetFirewallAddressFilter -ErrorAction Stop; 'RemoteAddress=' + \$f.RemoteAddress" > /tmp/d.out 2>&1
rc=$?; cat /tmp/d.out; cls "ADDRFILTER_QUERY" "$rc" /tmp/d.out

echo; echo "=== E. APPLICATION FILTER (per-rule) ==="
timeout 60 powershell -NoProfile -Command "\$ErrorActionPreference='Stop'; \$f = Get-NetFirewallRule -Name '$RULE' -ErrorAction Stop | Get-NetFirewallApplicationFilter -ErrorAction Stop; 'Program=' + \$f.Program" > /tmp/e.out 2>&1
rc=$?; cat /tmp/e.out; cls "APPFILTER_QUERY" "$rc" /tmp/e.out

echo; echo "=== F. NEGATIVE CONTROL: a rule name that must NOT exist ==="
timeout 60 powershell -NoProfile -Command "\$ErrorActionPreference='Stop'; Get-NetFirewallRule -Name '{00000000-0000-0000-0000-000000000000}' -ErrorAction Stop" > /tmp/f.out 2>&1
rc=$?; cls "NEGATIVE_CONTROL" "$rc" /tmp/f.out
echo "(must read RULE_MISSING for the predicate to be live)"