Method: identify the exact context your input lands in, then craft the payload that breaks OUT of that context. Prove execution by making your injected JavaScript call /m03/api/solve/r_attr (e.g. with fetch()). No external collector needed. Server-rendered sinks also auto-mark once a value that would run is reflected/stored here.
Your input is placed inside a double-quoted attribute value. A payload that works in the body context will just sit there as literal text - you have to close the attribute (and maybe the tag) first.