Serve index.html and use browser DevTools response overrides or an intercepting test proxy to return this JSON for https://api.squeekchain.com/v1/status: {"measurement": {"coreStatus": "<img src=x onerror="document.title=String(12345)">", "rpmMilli": 0}, "builder": {"anchor": {"blockHeight": "123", "settledThroughRound": "7", "blockProgress": "0"}}}.

Reload, press START, and let the hamster crash.

Expected: untrusted status is rejected or displayed literally.

Actual: the receipt contains an img element with the onerror handler instead of text; loading its invalid image executes the handler and changes the document title to 12345.

Execution of the unmodified page script in an in-memory DOM harness confirmed the exact unescaped img/event-handler string in receipt.innerHTML; the browser event itself was not exercised.

On index.html, open the console and execute this deterministic simulation of collecting versus skipping items:

soundOn=false; wheel.online=false;

pendingChallenge={name:'test',score:0,meters:0,seed:699864734};

function trace(collect){

startRun(); lastSkillType='shield'; const out=[];

for(let i=0;i<20000 && out.length<16;i++){

invulnT=100;

const p=pipes.filter(p=>p.x+(p.w||64)>=ham.x).sort((a,b)=>a.x-b.x)[0];

ham.y=collect&&p?p.gapY:60; ham.vy=0;

const prev=pipes.at(-1); update(1/120); const next=pipes.at(-1);

if(next && next!==prev) out.push({y:next.bossBaseY,score});

if(state==='wheel')exitWheel(); if(state==='crush')exitCrush();

}

return out;

}

console.log(trace(true)[12],trace(false)[12]);

Expected: identical thirteenth-column coordinates for the same seed, as promised by the menu and friend-challenge instructions. Actual (confirmed by running the unmodified page script): {y:325.97351305969244,score:12} versus {y:268.7153634182382,score:12}. Columns 1-12 match. The test keeps the player alive and aligns it to collect or skip items; collecting the first Super item changes which RNG calls run before the next obstacle is generated. The same trigger occurs in ordinary play when one challenger collects that item and the other misses it.

Start a run and fly into a purple portal (Cage Runner) or green portal (Bamboo Squeeze), then click Pause or press P.

Expected: the current mini-game freezes and the button changes to Resume.

Actual: the mode remains wheel/crush and the timer and physics continue.

Deterministic console reproduction on index.html: startRun(); enterWheel(); togglePause(); console.log(state, W2.t); update(1); console.log(state, W2.t).

The unmodified script produces wheel 10 followed by wheel 9.

For the other mode: startRun(); enterCrush(); togglePause(); update(1/120); console.log(state, CR.t) produces crush and 8.991666666666667 instead of a paused state with 9 seconds.