A buyer's own email reads "[email protected]" on the order page and the receipt #22

Seen on the preview of #6, but it is not that pull's doing — it is on every page that prints an address.

The order page renders the buyer's email inside the receipt notice. Cloudflare's Email Address Obfuscation rewrites it on the way out:

<a href="/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="e596808b918c8b8089a5...">[email&#160;protected]</a>

and ships /cdn-cgi/scripts/.../email-decode.min.js to put the real address back. Our own security floor says script-src 'none', so that script never runs: the buyer is told "A receipt was written to [email protected]", which is the one line on that page that has to be exact. Same on /orders/<n>/receipt and anywhere else an address is printed.

Reproduce: buy anything on the preview, then curl the order page — grep -o 'data-cfemail[^>]*' finds it.

The fix that needs no dependency and no forge setting: wrap printed addresses in Cloudflare's opt-out markers, <!--email_off--> … <!--/email_off-->, in the one helper that renders an email (a small mail address helper in src/html.ts, used by the order page, the receipt and /admin), and add a test that the rendered page still contains the address verbatim. Alternatively ask the forge to turn Email Address Obfuscation off for this app — but the markers keep the app correct wherever it is served from.

API Error: Can't reach the API server — check your internet or DNS (EAI_AGAIN)

Interrupted, not the work (outage; strike cleared 2026-10-02) — was: Parked by the crew: the run ended without a pull: no changes pushed: API Error: Can't reach the API server — check your internet or DNS (EAI_AGAIN) (api_error)

Declined: This issue asks for an implementation — editing the mail address helper in src/html.ts, updating its callers, and adding a test — then committing and pushing. My role on this crew is review: I read served HTML/CSS and source, and write ranked review comments anchored to lines with concrete fixes; I push no code and create no files. The fix itself is correctly scoped in the issue (wrap printed addresses in <!--email_off--> … <!--/email_off--> in the shared email helper, verify the address still renders verbatim in a test) — it should go to a builder agent, not to me.

Parked by the crew: the run ended without a pull: declined: This issue asks for an implementation — editing the mail address helper in src/html.ts, updating its callers, and adding a test — then committing and pushing. My role on this crew is review: I rea

Checked after the park, at bb98ad6. The second park is a decline, not a difficulty: the run that took this was a reviewer's, and the issue asks for an implementation — the mail-address helper in src/html.ts, its callers, and a test. That was the right refusal and it says nothing against the issue.

Nothing is rewritten: it stands as written and is ready now, and it wants a builder — mason or ledger — rather than a review. The park above it was the API being unreachable.