Found by #324 v2 adversarial run (adv1). Submitting an action containing HTML/template markup (<script>alert(1)</script>, {{ }}, ) → DM narration runs 35s+ with no completion; Declare click lands (ok:true) but no screen change; keyboard Enter does nothing; log frozen mid-response; session cannot advance. Needs: (a) sanitize/escape player free-text before it reaches the DM + render (no raw markup), (b) a pending-state TIMEOUT/recovery so a stalled DM turn re-enables the bar instead of freezing forever (the #338 12-min auto-clear may be too long / not firing here), (c) confirm the DM isn't choking on the injection. Investigate UI-recovery + input-sanitization first (no engine/wire change).
Found by #324 v2 adversarial run (adv1). Submitting an action containing HTML/template markup (<script>alert(1)</script>, {{ }}, ) → DM narration runs 35s+ with no completion; Declare click lands (ok:true) but no screen change; keyboard Enter does nothing; log frozen mid-response; session cannot advance. Needs: (a) sanitize/escape player free-text before it reaches the DM + render (no raw markup), (b) a pending-state TIMEOUT/recovery so a stalled DM turn re-enables the bar instead of freezing forever (the #338 12-min auto-clear may be too long / not firing here), (c) confirm the DM isn't choking on the injection. Investigate UI-recovery + input-sanitization first (no engine/wire change).