For 2, the server can send back a random number (let's call it a nonce) for that attempt session. This nonce can be used to seed the prng such that you couldn't

For 2, the server can send back a random number (let's call it a nonce) for that attempt session. This nonce can be used to seed the prng such that you couldn't have started the attempt before telling the server that you're starting, only after. 3 is not fully solvable I think, it's the same class of hacks as x-raying. You can only make it really difficult. At the end of the day, you can't control what's being rendered client-side, short of cloud gaming. I have seen ML approaches to detecting behaviour server-side for things that shouldn't be humanly possible (like seeing through a wall) but it's an arms race.