fix: escape member.name in step_email; add all-voted reminder test

backend/app/services/orchestrator/steps.py

@@ -145,7 +145,7 @@ def step_email(run: "WeeklyRun", db: "Session") -> None:
         email_html = (
             f"<h2>This week's meal suggestions</h2>"
             f"{stale_banner}"
-            f"<p>Hi {member.name}, please vote on this week's meals by Fri 17:00 PT:</p>"
+            f"<p>Hi {html.escape(member.name)}, please vote on this week's meals by Fri 17:00 PT:</p>"
             f"<ul>{''.join(item_html_parts)}</ul>"
             f"<p>Silence = approved. Any denial removes that meal.</p>"
         )

backend/tests/test_orchestrator.py

@@ -417,6 +417,36 @@ def test_step_reminder_skips_voter(
     assert weekly_run_emailed.reminded_at is not None
 
 
+def test_step_reminder_no_sends_when_all_voted(
+    db, weekly_run_emailed, meal_plan, pending_item, member, monkeypatch
+):
+    from app.models import MealPlanVote
+    # Member has voted on the only pending item
+    vote = MealPlanVote(
+        meal_plan_item_id=pending_item.id,
+        family_member_id=member.id,
+        vote=True,
+    )
+    db.add(vote)
+    db.flush()
+
+    sent = []
+
+    class FakeBackend:
+        def send(self, **kwargs):
+            sent.append(kwargs)
+
+    monkeypatch.setattr(
+        "app.services.orchestrator.steps.get_email_backend",
+        lambda: FakeBackend(),
+    )
+    from app.services.orchestrator.steps import step_reminder
+    step_reminder(weekly_run_emailed, db)
+    # All items voted on — no emails sent, but reminded_at still stamped
+    assert len(sent) == 0
+    assert weekly_run_emailed.reminded_at is not None
+
+
 # ---------------------------------------------------------------------------
 # step_deadline tests
 # ---------------------------------------------------------------------------