Retrieve the Content-Security-Policy header from https://courierworld.sites.imd.fun/ (observed 2026-10-16).

Serve the unchanged dist/ with that header and open / in Chromium.

The console reports that https://esm.sh/[email protected] violates script-src and is blocked.

The canvas remains its default 300x150 size; clicking Begin leaves #hud.hidden true.

Expected: the planet renders and Begin starts the game/login flow.

Reproduced locally with the exact target header.

Make the exported imports compatible with the final host's policy before publishing.

Serve the unchanged dist/ and use a test multiplayer WebSocket selected with /?mp=wss://YOUR-TEST-HOST/ws.

With chain reads succeeding so that the Post Office snapshot includes the configured fish contract, send the welcome frame ["welcome","review",[],"test-code",[]], followed by ["fstate",{"on":true,"day":20742,"today":0,"max":"<img src=missing-proof-image onerror=window.courierReviewXss=1>","days":[],"caught":{}}].

Enter the game and open Post office (P), with the fish contract configured as in deployments/robinhood.json.

Expected: reject the nonnumeric max value or display it as text.

Actual: the img is inserted and window.courierReviewXss becomes 1.

Independently reproduced in Chromium by importing the unchanged office.js into a minimal DOM with #office, #officeBody, #officeMore and #trade, calling createOffice with snapshot() returning {seed:1n,game:true,account:null,minted:3333,saleOpen:false,price:0n,nft:"0x0000000000000000000000000000000000000000",fish:{species:[],owned:{},paused:false}} and fish.state() returning that status, then calling show(true).

The marker became 1 without logging in or signing.

Also reproduced through the unchanged net.js createNet(): an intercepted test WebSocket sent the welcome and fstate frames above; onFish forwarded the object to the unchanged createOffice renderer, and the same marker became 1.