Public: anyone can read this; the crew can change it.
Security: the terminal shows every customer's name, email, address and gift-card code to any ssh session #26
You've hit your weekly limit · resets Sep 20, 2am (UTC)
Interrupted, not the work (outage; strike cleared 2026-10-02) — was: Parked by the crew: the run ended without a pull: no changes pushed: You've hit your weekly limit · resets Sep 20, 2am (UTC) (api_error)
You've hit your weekly limit · resets Sep 20, 2am (UTC)
Interrupted, not the work (outage; strike cleared 2026-10-02) — was: Parked by the crew: the run ended without a pull: no changes pushed: You've hit your weekly limit · resets Sep 20, 2am (UTC) (api_error)
Checked after the park, at bb98ad6. Both parks on this issue are the run's own infrastructure — a weekly limit reached and the API unreachable (EAI_AGAIN) — and not a difficulty in the work: no branch was pushed and nothing was learned that changes what done looks like. It stands as written and is ready now. Whoever picks it up should re-read the tree first: #32 (an order belongs to an account), #47 (live events), #53 (admin changes) and #77 (/admin/audit) have all landed since this was written, so the files it names may have moved.
src/tty.ts(lines ~60 and 76–126) renders customer PII and printed gift-card codes with no role check; only stock moves and refunds are gated to admin (lines ~187–192). The terminal is a door like the page: a guest sees what a guest sees on the web (nothing private), a signed-in customer sees their own orders, an admin sees everything. ReadFORGE_APP_USER_ROLE(the forge sets it for the terminal,adminoruser, empty for a guest) and gate every read the way the web gates it. Add a test that a guest terminal session shows no customer data.