R1.05 HMI tests with temporary displays: web trend, web browser CSP

With the user's approval two temporary displays were deployed, viewed in
the web client and removed (display folders identical before/after):
- a 2-pen trend draws on the R1.05 web client (ISS-096 closed; ISS-041
  fixed on R1.05);
- the default R1.05 Content-Security-Policy blocks external pages in a
  web browser component; same-origin pages load (ISS-111).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.claude/skills/graphics/tasks/create-display.md

@@ -83,7 +83,7 @@ Module, the Operator Interface and the HTML display, if these rules are kept (sa
 | Actions sheet (§4.12, R1.04) | *Update item/parameter* on an item, object signal or parameter can carry **Reason** (≤ 256 chars) and **Approver** (≤ 128 chars); they land in `AUDIT_TRAIL` fields `APPROVAL_REASON` / `APPROVER` (skill `audit-trail`). Two documented recipes for alarm acknowledgement with reason/approver: via an item parameter (attribute *Acknowledged* = 1, item alarms only) or via the overview's *External Acknowledgement* properties (item and external alarms). Not tested. |
 | Dataset tables (§2.25, R1.05) | Column **Icon**, *Icon filter* (`<v>`, `!<v>`, `&<v>` bit test), *Icon tooltip*; *Operator can use column sorters*; *Operator can select row(s)* / *multiple rows*; *[Enterprise Dataset Locations]*; enterprise location supported on the HTML display. |
 | Report (§2.26, R1.05) | New *[Enterprise]* category (primary / secondary data location). |
-| Web Browser (§2.33, R1.05) | New browser engine: protocols WebRTC, HTTPS, WebSocket, HTTP/2, HTTP/3; codecs VP8, VP9, WebM, Opus, Vorbis, PCM. Content that played on R1.04 or earlier may not play after the upgrade. Right-click menu; new properties *Go Home/Stop/Reload*, *[Printing]*, *[Status]*, *[Security]* (*Enable Microphone/Camera*, *Allow Insecure Certificates*, *Allow Local file access*). Local files for CI Mobile View must be placed under `%TLS_ALLUSERS_PATH%\wap` and opened by URL. |
+| Web Browser (§2.33, R1.05) — **web client: external pages are blocked** by the R1.05 default Content-Security-Policy (verified 2026-10-09, ISS-111); only pages from the CI Server itself load. Component type `extendedIExplorer` (class `WebBrowserChromium`), property `url` | New browser engine: protocols WebRTC, HTTPS, WebSocket, HTTP/2, HTTP/3; codecs VP8, VP9, WebM, Opus, Vorbis, PCM. Content that played on R1.04 or earlier may not play after the upgrade. Right-click menu; new properties *Go Home/Stop/Reload*, *[Printing]*, *[Status]*, *[Security]* (*Enable Microphone/Camera*, *Allow Insecure Certificates*, *Allow Local file access*). Local files for CI Mobile View must be placed under `%TLS_ALLUSERS_PATH%\wap` and opened by URL. |
 | Display generator (§2.36) | The note "not supported on HTML displays" was removed in the R1.05 manual; R30 §4.8 does not list it. Treat web support as unconfirmed. |
 | `jwuiutl -m` / `-M` (§1.5) | Output now described as space-separated (R1.03 manual: CSV). On R1.03 `-m` printed comma-separated lines (verified); R1.05 output not checked (ISS-094). |
 

.claude/skills/graphics/tasks/trend.md

@@ -150,7 +150,14 @@ rotation, zoom. Outputs (⇨): *Hairline value[n]*, *Time range begin/end*, *Upd
   `SYSTEM.CPU_LOAD`) gives the message *Record not found* when the display opens, on the desktop
   and on the web (tested 2026-10-06): set it false for such items.
 
-## R1.05: the 50-pen problem is probably fixed (V5, 2026-10-09, from code, not tested)
+## R1.05: the 50-pen problem is fixed (verified on the web 2026-10-09)
+
+**Verified** with a temporary display on the R1.05 test server (copy of `CIENG_Trends`, 2 pens on
+items that already store history; removed afterwards): the web client drew both pens, history
+and live part, without spare pens. The padding workaround below is only needed on R1.03. The
+desktop Operator Interface was not checked (ISS-096 closed).
+
+### Cause (from the code)
 
 `PEN_COUNT_LIMIT` is still 50 in the R1.05 web client, but `trend/datasources/DataSource.js`
 changed (change e12620, Oct-24, "revert previous change to enable component to function

.claude/skills/portal-setup/tasks/check-web-access.md

@@ -76,3 +76,17 @@ service account), `http://localhost:8080/` and `https://localhost:8443/` both 20
 offers `CI-rc-setup.exe` (Remote Connect), the six `DEPLOY` folders present, and the seven
 headers plus CSP listed above on both ports. Install paths differ from R1.03 (here
 `C:\Yokogawa\CIServer`), so always use the `TLS_*` variables.
+
+## R1.05: the CSP blocks external pages in displays (verified 2026-10-09, ISS-111)
+
+Tested with a temporary display holding two web browser components on the R1.05 test server
+(removed afterwards). The web client received `Content-Security-Policy: script-src 'self'
+'unsafe-eval' 'unsafe-inline'; img-src 'self' data:; default-src 'unsafe-inline' 'self';
+font-src 'self' data:` and `X-Frame-Options: sameorigin`. With no `frame-src` rule,
+`default-src` applies: the browser refused to frame `https://example.com/` (a
+`securitypolicyviolation` event for `frame-src`), while a page from the CI Server itself
+loaded. So on R1.05 a display with an external web page (a dashboard, a camera, a vendor page)
+stays empty in the browser. Possible fix, **not tested**: add a `CSP_ENTRY` with
+`frame-src 'self' https://<allowed host>` on the *Security* tab of `jwuiisg.sup` (administrator;
+check whether the web server needs a restart). The desktop Operator Interface (JCEF browser) is
+not affected by these headers (not tested).

examples/CI-Eng-Sample/README.md

@@ -225,7 +225,7 @@ fill any monitor (slightly stretched where the ratio differs); maximise the wind
 the taskbar. The web client does not zoom displays: use full screen (F11) and the browser zoom
 (estimates, not tested: about 100 % at 1920 x 1080, 80 % at 1536 x 864, 70 % at 1366 x 768).
 
-Known limits (R1.03.00): the trend draws no line in the browser (a web trend needs 50 pens,
+Known limits (R1.03.00; on R1.05 the web trend draws with 2 pens, verified 2026-10-09): the trend draws no line in the browser (a web trend needs 50 pens,
 ISS-041; the 2-pen trend keeps the desktop hairline box readable); the empty part of the alarm
 lists stays white; a tab opened by clicking the tab strip itself keeps its zoom until it is opened
 once from the toolbar, menu or F1–F6.

knowledge/issues.md

@@ -60,7 +60,7 @@ development system (see "Test system" in `progress.md`); they do not exist on ot
 | ISS-038 | 2026-10-01 | HISTORY (`ithloahis` + rollover) | An `ithloahis` sample that was dropped (dated 11:50, before the active unit) still became the **initial value** of the next unit: after a forced rollover at 12:05:26 `ITEM_HISTORY` shows `CI-Eng-Sample.TANK1.INFLOW` = 95 (`INITIAL_VALUE` 1) although the item's value was 112. History after loading old samples can therefore show a wrong value at the next rollover. | closed | Retested 2026-10-01 after a CI Server restart (first unit 18:05:46). (a) Sample dated one day earlier (95), live value 112, forced rollover: initial value 112 — correct. (b) Sample dated 18:00 (96, a few minutes before the first unit), live value 113, forced rollover: initial value **96** — wrong again; the live item value stayed 113. So a dropped sample dated shortly before the first unit (same day) becomes the next unit's initial value; a much older one did not. Also found: a forced rollover within 2 minutes of the previous one is refused (`DSI-E-ROLLDONE`). Documented as a caution; behaviour confirmed, ready to close. Closed 2026-10-01 (confirmed by user). | `.claude/skills/system-management/tasks/load-history.md`; `knowledge/manuals/IM36K10C40-01EN.md` §3 |
 | ISS-039 | 2026-10-01 | HISTORY (setup) | Installed vs manuals: `hisdbg` menu runs to option 22 (manual text: `-1 - 10`, list to 22) and lists history types 4 (`STATION_STAT`) and 36 (`SYS_LOG`) not in IM 36K10L20 §3.1; `ithsag.sup` keyword `run_interval` (manual: *Heartbeat*) and `queue_size` 500 KB (manual default 200); the option-type table in IM 36K10L20 §3.1 is garbled in the PDF (observed: Scan/Time `1 1`, Event/Item `2 2`, Aggregation `4 4`). | closed | Installed software is the reference (standing user decision). Close when the user confirms. Closed 2026-10-01 (confirmed by user). | `knowledge/manuals/IM36K10L20-01EN.md` §3; `knowledge/manuals/IM36K10C40-01EN.md` §2 |
 | ISS-040 | 2026-10-01 | HISTORY (aggregation) | Aggregation group `CIENG_AGG` (30 min + hour, `TANK1.LEVEL` max/min/avg) ran (`ithsag.log`: *Aggregation Completed*) but stored no values: retrieval gave `0x09 = ITM error` per period. `TANK1.LEVEL` was in `CIENG_EVENT` and `CIENG_SCAN10S`, both priority 0. Also `INTERPOLATION = "30 minutes"` is refused by `dssqld`; the installed name is `30Minutes`. | closed | Closed 2026-10-01 (confirmed by user). 2026-10-01 14:02: after `CIENG_SCAN10S` got `PRIORITY` 10, the 13:30–14:00 period stored max 77, min 33, avg 52.7, quality 1000 (`ithdbg` 20 and `dssqld` with `INTERPOLATION = "30Minutes"`). Cause: equal source priorities (C40 §2.1 says the highest-priority group is the source, but not that a tie gives nothing). Sample fixed (priority 10). The hourly value for 13:00–14:00 was not stored (first half had no source); not rechecked. Proposed close. | `.claude/skills/history-management/tasks/storage-groups.md` §4 (done); `knowledge/manuals/IM36K10C40-01EN.md` §3 (done); `examples/CI-Eng-Sample/03_his_group_df.qli`, `README.md` (done) |
-| ISS-041 | 2026-10-01 | GRAPHICS (HTML trend) | In the HTML display (`localhost:8080/mobileoperator/?d=CIENG_Tank`) the trend shows the pen legend `CI-Eng-Sample.TANK1.LEVEL [CIENG_SCAN10S]` and time axis but draws no line, although `ITEM_HISTORY` has 420 samples in the shown hour. Browser console: `Mismatch between number of labels (Time,CI-Eng-Sample.TANK1.LEVEL [CIENG_SCAN10S]) and number of columns in array (51)`. The trend has 4 further empty pens. 2026-10-01 later: the trend also had the property `chart.attribute[00]` connected to `TANK1.LEVEL` (added by mistake with the pen); the Operator Interface (desktop) showed *Short attribute name ( 61.0) is invalid*. After removing it the desktop trend draws the line, but the HTML trend still logs the mismatch error. | closed | Tried 2026-10-01 (fresh session after a restart, 283 history samples in the hour): removing the 4 empty pens, and `updating` true / `updateInterval` 10 like the factory `AOG_TrendOpen` — the mismatch error and the empty trend stayed in both cases (changes reverted). Still to try: a Micro Trend, the HTML-supported trend properties (IM 36K10R30 §4.8.7), clearing the browser/`MO_CACHE_DISPLAYS` cache (the console shows `CIENG_Tank.xml` *loaded (from cache)*), and adding the pen to the factory *Open Trend* display in the HTML client. **Cause found 2026-10-02** (trend lab `CIENG_TrendLab`): a web-client defect, not a display setting. `DataSource.refresh()` in the web trend code (`mobileoperator\src\…\charts\trend\datasources\DataSource.js`, same in the served `src\lib\fasttools.min.js`) numbers **all 50** internal pen slots (`PEN_COUNT_LIMIT`; the filter for empty/hidden pens is commented out), so each data row has 51 columns, while the dygraph labels only list visible pens with an item. Proof: a 50-pen test display drew normally in the browser. Ruled out on the way: the `?historygroup` suffix, empty pens, `optimised`. **Workaround** (verified on the web): pad each trend to 50 visible pens with `displays/add_trend_spares.ps1` (spares scaled out of view, blank unique legend texts); sample `CIENG_TrendLab` uses it. Alternatively a Micro Trend (ISS-055). Report to Yokogawa. Close when the user confirms. Closed 2026-10-02 (confirmed by user). | `.claude/skills/graphics/tasks/trend.md` (done); `create-display.md`, `deploy-displays.md` (done); `knowledge/manuals/IM36K10R30-01EN.md` §4 (done) |
+| ISS-041 | 2026-10-01 | GRAPHICS (HTML trend) | In the HTML display (`localhost:8080/mobileoperator/?d=CIENG_Tank`) the trend shows the pen legend `CI-Eng-Sample.TANK1.LEVEL [CIENG_SCAN10S]` and time axis but draws no line, although `ITEM_HISTORY` has 420 samples in the shown hour. Browser console: `Mismatch between number of labels (Time,CI-Eng-Sample.TANK1.LEVEL [CIENG_SCAN10S]) and number of columns in array (51)`. The trend has 4 further empty pens. 2026-10-01 later: the trend also had the property `chart.attribute[00]` connected to `TANK1.LEVEL` (added by mistake with the pen); the Operator Interface (desktop) showed *Short attribute name ( 61.0) is invalid*. After removing it the desktop trend draws the line, but the HTML trend still logs the mismatch error. | closed | R1.05 (2026-10-09): fixed on the web client, see ISS-096. Tried 2026-10-01 (fresh session after a restart, 283 history samples in the hour): removing the 4 empty pens, and `updating` true / `updateInterval` 10 like the factory `AOG_TrendOpen` — the mismatch error and the empty trend stayed in both cases (changes reverted). Still to try: a Micro Trend, the HTML-supported trend properties (IM 36K10R30 §4.8.7), clearing the browser/`MO_CACHE_DISPLAYS` cache (the console shows `CIENG_Tank.xml` *loaded (from cache)*), and adding the pen to the factory *Open Trend* display in the HTML client. **Cause found 2026-10-02** (trend lab `CIENG_TrendLab`): a web-client defect, not a display setting. `DataSource.refresh()` in the web trend code (`mobileoperator\src\…\charts\trend\datasources\DataSource.js`, same in the served `src\lib\fasttools.min.js`) numbers **all 50** internal pen slots (`PEN_COUNT_LIMIT`; the filter for empty/hidden pens is commented out), so each data row has 51 columns, while the dygraph labels only list visible pens with an item. Proof: a 50-pen test display drew normally in the browser. Ruled out on the way: the `?historygroup` suffix, empty pens, `optimised`. **Workaround** (verified on the web): pad each trend to 50 visible pens with `displays/add_trend_spares.ps1` (spares scaled out of view, blank unique legend texts); sample `CIENG_TrendLab` uses it. Alternatively a Micro Trend (ISS-055). Report to Yokogawa. Close when the user confirms. Closed 2026-10-02 (confirmed by user). | `.claude/skills/graphics/tasks/trend.md` (done); `create-display.md`, `deploy-displays.md` (done); `knowledge/manuals/IM36K10R30-01EN.md` §4 (done) |
 | ISS-042 | 2026-10-01 | GRAPHICS (layouts) | Installed vs `Layouts.readme`: the factory layouts use status line item types `displayName`, `playbackIndicator` and `dateTime` and the commands `reload <frame>` / `reload all`, none of which the readme lists (readme: `statusText`, `userName`, `progresBar`, `graphicsQueueLevel`, `connectionState`); the readme also writes `zooom` for the zoom command (factory files use `zoom`). | closed | Installed software is the reference (standing user decision). Close when the user confirms. Closed 2026-10-01 (confirmed by user). | `.claude/skills/graphics/tasks/layouts.md` §2 |
 | ISS-043 | 2026-10-01 | REPORT (system reports) | IM 36K10C30 App. 1.3 names two system reports `ALM_ATTS_CUR` and `ALM_ATRS_HIS`; the installed reports are `ALM_ATTRS_CUR` and `ALM_ATTRS_HIS`. The other 26 names match. | closed | Installed software is the reference (standing user decision). Close when the user confirms. Closed 2026-10-01 (confirmed by user). | `knowledge/manuals/IM36K10C30-01EN.md` §8 (done) |
 | ISS-044 | 2026-10-01 | REPORT (scheduling) | Behaviour not in the manuals, found by quick load: a generation interval below 10 minutes is refused (`HIS-E-ROLLTOFAST`, the interval is the rollover of the report's storage group); a scheduled report cannot be deleted (`RPT-E-ACTIVE`) until `ACTIVATION_TIME` and `GENERATION_INTERVAL` are cleared; `CORRECT_DAYLIGHT` 0 counts intervals in UTC (06:00 set for January ran at 05:00 in October); a past activation time moves to the next slot - once (modify, past time within the lifetime) a single report labelled with the old time was generated, at insert with an older time none. | closed | Documented as verified behaviour; the one-off generation for a past activation time is not fully understood. Close when the user confirms. Closed 2026-10-01 (confirmed by user). | `.claude/skills/reporting/tasks/define-reports.md` §1, §5, §6; `knowledge/manuals/IM36K10C30-01EN.md` §2; `examples/CI-Eng-Sample/83a_stop_report_df.qli`, `18_report_df.qli` |
@@ -115,7 +115,7 @@ development system (see "Test system" in `progress.md`); they do not exist on ot
 | ISS-093 | 2026-10-08 | GRAPHICS (HTML display enterprise / restrictions) | IM 36K10R30 4th ed. marks enterprise operation as supported on the HTML display (§4.4, §4.7.15 removed, §4.8) and changes §4.10: no more "no automatic reconnect" and "no HTML export from CI View"; new "HIS-TSE not supported on the web". Not in the revision table in that detail. | open | Not tested (no enterprise setup; shared server). | `knowledge/manuals/IM36K10R30-01EN.md` (done); `.claude/skills/graphics/tasks/deploy-displays.md` (done) |
 | ISS-094 | 2026-10-08 | GRAPHICS (`jwuiutl`) | IM 36K10C50 5th ed. §1.5 describes `jwuiutl -m/-M` output as space-separated; on R1.03 it was comma-separated. On R1.03 an export without `-o` wrote into `mobileoperator\operatorInterfaces\<deployment>`, not the current directory as the help says. R1.05 behaviour not checked. | open | 2026-10-09 (V5): jwuiutl --help identical to R1.03; -m output format still unchecked. `jwuiutl --help` is read-only (V5); a search run only on a non-shared system. | `knowledge/manuals/IM36K10C50-01EN.md` (done); `.claude/skills/graphics/tasks/deploy-displays.md` (done) |
 | ISS-095 | 2026-10-08 | GRAPHICS (HTML display login, corrects ISS-074) | IM 36K10R30 §4.4 Table 4.4-1 marks the profile *Layout* as supported on the HTML display in both R1.03 and R1.05; a table-aware extraction shows it clearly. ISS-074's "layout not" came from a garbled text extraction: manual and software agree. | closed | ISS-074 closed by this. Close when the user confirms. | `knowledge/manuals/IM36K10R30-01EN.md` (done); `.claude/skills/graphics/tasks/layouts.md` (done) |
-| ISS-096 | 2026-10-08 | GRAPHICS (web trend 50 pens, R1.05) | Not known whether the R1.05 web client still draws a trend only with 50 visible pens (ISS-041). | open | 2026-10-09 (V5): PEN_COUNT_LIMIT still 50, but DataSource.js re-enables the empty/invisible-pen checks commented out in R1.03 (change e12620) - probably fixed; test on a non-shared system. Check `PEN_COUNT_LIMIT` in the R1.05 mobileoperator chart code (V5) or test on a non-shared system. Workaround kept. | `.claude/skills/graphics/tasks/trend.md` (done) |
+| ISS-096 | 2026-10-08 | GRAPHICS (web trend 50 pens, R1.05) | Not known whether the R1.05 web client still draws a trend only with 50 visible pens (ISS-041). | closed | 2026-10-09: verified on the web with a temporary 2-pen trend display: both pens draw (history and live). Desktop not checked. 2026-10-09 (V5): PEN_COUNT_LIMIT still 50, but DataSource.js re-enables the empty/invisible-pen checks commented out in R1.03 (change e12620) - probably fixed; test on a non-shared system. Check `PEN_COUNT_LIMIT` in the R1.05 mobileoperator chart code (V5) or test on a non-shared system. Workaround kept. | `.claude/skills/graphics/tasks/trend.md` (done) |
 | ISS-097 | 2026-10-08 | GRAPHICS (AOG demo displays) | IM 36K10C60 R1.04 §1.2.2 names `AOG_UAC_Method_Demo`, `AOG_UAC_MethodArg_Call2`, `AOG_OPCUA_Methods`; the R1.03 machine has `AOG_UAC_Method_Demo`, `AOG_UAC_MethodArg_Call`, `AOG_UAC_Method_Call`. R1.05 names not listed yet (the data-access re-check saw `AOG_UAC_Method_Demo`, `…_Call`, `…_MethodArg_Call(2)`). | closed | 2026-10-09 (V5): R1.05 adds AOG_UAC_MethodArg_Call2; AOG_OPCUA_Methods (named in C60 §1.2.2) is not installed. Installed software is the reference. Part of V5. | `knowledge/manuals/IM36K10C60-01EN.md` (done) |
 | ISS-098 | 2026-10-08 | GRAPHICS (Generic Functions) | IM 36K10C50: *Calculation/Function* renamed *Generic Functions*; new operations Password Check (R1.04; needs login method *Manual CI Server* / *Manual OS* for the Password Check function in `dssana.sup`) and RDP Connect (R1.05, `tls\com\connectrdp.cmd`). | open | 2026-10-09: authorization part done (ISS-148: login lines and allowed methods documented in `login-methods.md`). Not tested (Edit Module and an RDP target needed). Cross-reference in skill `authorization` to be added in its re-check. | `.claude/skills/graphics/tasks/create-display.md` (done); `knowledge/manuals/IM36K10C50-01EN.md` (done); `.claude/skills/authorization` (open) |
 | ISS-099 | 2026-10-08 | GRAPHICS / AUDIT (custom alarm acknowledgement) | IM 36K10C50 R1.04/R1.05 §2.22, §4.12: custom and external acknowledgement properties; reason and approver are written to `AUDIT_TRAIL` fields `APPROVAL_REASON` / `APPROVER`. | open | 2026-10-09: audit part done (ISS-140), alarm task §4.1 added; behaviour still not tested. Not tested. Skill `audit-trail` to mention the fields in its re-check. | `.claude/skills/graphics/tasks/create-display.md` (done); `.claude/skills/audit-trail` (open) |
@@ -126,7 +126,7 @@ development system (see "Test system" in `progress.md`); they do not exist on ot
 | ISS-108 | 2026-10-08 | PORTAL (installation media) | IM 36K10R10 4th ed. §3.1 (R1.04): CI Portal setup runs from the mounted CI Server ISO file instead of the DVD; not in the revision table. §3.3 only gained a reference to IM 36K10L30 ch. 3. | closed | Documented. Close when the user confirms. | `knowledge/manuals/IM36K10R10-01EN.md` (done) |
 | ISS-109 | 2026-10-08 | PORTAL / BUS (`dur.sup`) | R1.05 `dur.sup` has a new switch `gateway_core` (General tab, installed No) and a new adaptive queue set `ADTSTO, 1.00`. IM 36K10R10 does not mention them; see ISS-116 for the gateway configuration. | closed | Installed software is the reference. Close when the user confirms. | `knowledge/manuals/IM36K10R10-01EN.md`, `.claude/skills/portal-setup/SKILL.md` (done) |
 | ISS-110 | 2026-10-08 | PORTAL (`jwuiisg.sup` keywords) | R1.05 `jwuiisg.sup` has keywords IM 36K10R10 §4.3 does not describe: `SERVER_FILE_CACHE`, `HTTP_TO_HTTPS_REDIRECT`, `RECONNECT_TIMEOUT_OVERRIDE`, and a new tab *Access Control* (`RESTRICT_IP_ACCESS`, `HOSTNAME_WHITELISTING`). | closed | Installed software is the reference; documented from the file's own help. Close when the user confirms. | `knowledge/manuals/IM36K10R10-01EN.md`, `.claude/skills/portal-setup/tasks/check-web-access.md` (done) |
-| ISS-111 | 2026-10-08 | PORTAL (web security headers, CSP) | R1.05 `jwuiisg.sup` installs 7 security response headers and 9 `CSP_ENTRY` lines (R1.03: only X-Frame-Options, no CSP); verified in the HTTP responses on 8080/8443. | open | Open question: does the CSP block external content in displays (web browser component, external images, map viewer)? Not tested. Upgraded systems may keep their old settings depending on the merge. | `knowledge/manuals/IM36K10R10-01EN.md`, `.claude/skills/portal-setup/tasks/check-web-access.md` (done); `.claude/skills/graphics` (open) |
+| ISS-111 | 2026-10-08 | PORTAL (web security headers, CSP) | R1.05 `jwuiisg.sup` installs 7 security response headers and 9 `CSP_ENTRY` lines (R1.03: only X-Frame-Options, no CSP); verified in the HTTP responses on 8080/8443. | open | 2026-10-09: answered with a temporary display - the default R1.05 CSP (no frame-src, default-src self) blocks external pages in a web browser component on the web client; same-origin pages load. Possible fix (not tested): a CSP_ENTRY with frame-src for the allowed host. Open question: does the CSP block external content in displays (web browser component, external images, map viewer)? Not tested. Upgraded systems may keep their old settings depending on the merge. | `knowledge/manuals/IM36K10R10-01EN.md`, `.claude/skills/portal-setup/tasks/check-web-access.md` (done); `.claude/skills/graphics` (open) |
 | ISS-112 | 2026-10-08 | SETUP FILE EDITOR (`jwuiisg.sup` metadata) | R1.05 `jwuiisg.sup` metadata quirks: two keyword blocks end with `!ENDKEYWORD!`; `SERVER_FILE_CACHE=0` without spaces in `!DEFAULT`; `RECONNECT_TIMEOUT_OVERRIDE` has no active or default line; `RESTRICT_IP_ACCESS` has no keyword for the allowed addresses. | open | Awaiting user verification in the Setup File Editor GUI (V7). | `knowledge/manuals/IM36K10R20-01EN.md`, `IM36K10R10-01EN.md` (done) |
 | ISS-113 | 2026-10-08 | SETUP FILE EDITOR (R1.05 GUI) | R1.05 `fsuedit.cmd` only adds `tls\exe\lib\*` to the class path; metadata keywords and `!KIND`s unchanged. The R1.03 GUI findings (ISS-015/016) are not re-checked on R1.05. | open | Awaiting user verification (V7). | `knowledge/manuals/IM36K10R20-01EN.md`, `.claude/skills/portal-setup/tasks/change-setup-file.md` (done) |
 | ISS-116 | 2026-10-08 | BUS / SYSTEM DESIGN (gateway core) | IM 36K10J10 5th ed. has a new §3.2.6 *Gateway* configuration, not in the revision table: a gateway-licensed CI Core has no operator interface (nor do CI Portals / CI View connected to it); switched on with `GATEWAY_CORE` in `dur.sup`; a licence/switch mismatch is logged. IM 36K10L30 does not describe the keyword. | open | Not tested (no gateway licence; needs admin and a restart). | `knowledge/manuals/IM36K10J10-01EN.md`, `IM36K10L30-01EN.md`, `.claude/skills/system-management/tasks/bus-utilities.md` (done) |

knowledge/r105-verification.md

@@ -179,3 +179,14 @@ is removed again afterwards. Scripts: `examples/CI-Eng-Sample/shared/`.
   server store) and the `pkiserver\rejected` folder created by the test were deleted with the
   user's approval. `OPCUAC_PKI_CERTIFICATES_DF` went back from 3 to 1 record by itself: the
   dataset follows the certificate files. The server is back in its original state.
+
+## HMI tests with temporary displays (2026-10-09)
+
+With the user's approval: two temporary displays `CIENG_TEST_TREND` and `CIENG_TEST_WEB` were
+copied into `DEPLOY\displays`, exported to HTML with `jwuiutl -e HTML`, viewed in the web client
+(logged in as an existing password-less user, as the user said), and deleted again; both
+display folders were compared before and after (identical). No existing display or
+`Layouts.xml` was touched.
+- Trend with 2 pens: draws on the web (ISS-096 closed; `graphics/tasks/trend.md`).
+- Web browser component: external pages are blocked by the default CSP, same-origin pages load
+  (ISS-111; `portal-setup/tasks/check-web-access.md`).