{f.body}
{strings.empty_state}
)} {[...bySeason.entries()].sort(([a], [b]) => a - b).map(([season, frags]) => ({f.body}
{fragment.body}
` with text content (not HTML); `userSelect: 'text'` doesn't change escape semantics. No dangerouslySetInnerHTML in Journal or RevealModal. | | T-02-03-04 | Tampering | Selector returns same fragment via seed manipulation | accept | Seed is pure function of sim state; even if a player manipulates state, no-dup logic ensures progression. | | T-02-03-05 | Denial-of-service | Massive fragment file slows initial load | mitigate | PIPE-02 lazy split keeps Season-2-7 out of initial bundle. Phase 2 only ships Season 1 (~12 fragments, <10KB). check-bundle-split.mjs verifies the lazy structure. | No `high` severity threats. The selector + content surface is small and well-bounded.