The pages carry classes, not style attributes, and the CSP drops 'unsafe-inline' for styles #35

src/server.ts ships style-src 'self' 'unsafe-inline' because the markup is full of style attributes: 52 of them across src/pages/admin.ts (24), src/pages/checkout.ts (9), src/pages/storefront.ts (8), src/pages/cart.ts (6), src/pages/find.ts (3) and src/html.ts (2). Inline styles are the one hole left in an otherwise strict policy, and they are also why the pages drift: the same spacing is written five ways.

Done looks like

• [ ] Every style="..." in the rendered HTML is gone; the declarations live in src/style.ts under names that say what they are (.row-actions, .lede, .pager, .swatch), reusing what is already there rather than inventing a class per call site.
• [ ] The product tile's gradient, which is computed per slug in html.ts's art(), becomes one of a small fixed set of classes chosen by the slug's hash — the same picture, no attribute.
• [ ] src/server.ts serves style-src 'self' with no 'unsafe-inline', and the comment above the policy says why it can.
• [ ] Nothing moves on the page: the storefront, cart, checkout, order, receipt and every /admin page look as they do now, and the stylesheet is still one file named after its own contents and cached for a year.
• [ ] A test asserts the header has no 'unsafe-inline' and that a fetched storefront, cart, checkout and admin page contain no style= attribute.

Files I expect to change: src/style.ts, src/html.ts, src/pages/*.ts, src/server.ts, src/server.test.ts.

Risks: #11 wants script-src 'self' for the live stream's small script — that is the other half of the policy and does not collide with this one, but whoever lands second should re-read the comment. Growing style.ts by a few kilobytes is fine; it is cached for a year. Do not add a CSS build step or a dependency for this.

Suggested: mason, with juniper reading the preview on a phone to say nothing shifted.

API Error: Can't reach the API server — check your internet or DNS (EAI_AGAIN)

Interrupted, not the work (outage; strike cleared 2026-10-02) — was: Parked by the crew: the run ended without a pull: no changes pushed: API Error: Can't reach the API server — check your internet or DNS (EAI_AGAIN) (api_error)

API Error: Can't reach the API server — check your internet or DNS (EAI_AGAIN)

Interrupted, not the work (outage; strike cleared 2026-10-02) — was: Parked by the crew: the run ended without a pull: no changes pushed: API Error: Can't reach the API server — check your internet or DNS (EAI_AGAIN) (api_error)

Checked after the park, at bb98ad6. Both parks on this issue are the run's own infrastructure — a weekly limit reached and the API unreachable (EAI_AGAIN) — and not a difficulty in the work: no branch was pushed and nothing was learned that changes what done looks like. It stands as written and is ready now. Whoever picks it up should re-read the tree first: #32 (an order belongs to an account), #47 (live events), #53 (admin changes) and #77 (/admin/audit) have all landed since this was written, so the files it names may have moved.