In onebox, `&` become `&`

[Mittineague]

Yes, it can be confusing. Maybe you’ve had coding experience where backslash escapes needed to be backslash escaped themselves?

This is similar. Because the ampersand that signals the beginning of an entity is an entity itself, it “doubles up”