c_25172cf8caa0784466

Both patches implement the same core fix (drop shared sentinel delegates so multi-user votes work) with identical new tests, but B goes further and cleans up all the now-dead sentinel machinery: it removes the unused `is_browser_sentinel_delegate` helper and its `mod.rs` re-export, simplifies `authorship_attr`/`authorship_color_seed` in `html/mod.rs` to drop sentinel-checking branches, and deletes the now-obsolete `browser_sentinel_delegate_shows_username` test. A leaves this related dead code and tests untouched, so B's diff represents a more complete and consistent refactor with less leftover cruft.

Both commits implement the same core fix (Optional agent, drop shared WEB_BROWSER_AGENT/INVITE sentinels, multi-user vote test). B adds lasting cleanup Side A omits: deleting is_browser_sentinel_delegate, simplifying authorship_color_seed/authorship_attr in html/mod.rs to None-vs-Some, and removing related exports and sentinel unit tests.

Both commits implement the core fix by changing pending sessions and poll responses to use `Option<String>` for delegates, removing browser sentinel delegates, updating UI posts to pass `None`, and adding an integration test proving two browser users can vote without `AgentBound` conflicts. Side B goes further by removing the obsolete browser-sentinel attribution logic (`is_browser_sentinel_delegate`, related re-exports, and HTML rendering/tests), simplifying authorship handling so the codebase consistently treats browser users as having no delegate rather than preserving legacy sentinel behavior.

Side A fixes a real concurrency bug (shared browser sentinel delegate blocking multi-user votes) with a coherent design change across server, CLI, types, and tests, including a new integration test proving the fix. Side B is a minor cosmetic HTML cleanup removing headers/labels with no functional change or test coverage, offering far less lasting value.

A fixes a real multi-user correctness bug by removing shared browser sentinel delegates (PendingSession.agent becomes Option, votes/posts use no delegate, authorship simplified) with integration coverage; B only deletes cosmetic forum chrome (compose heading/help text and thread subtitle/garden link).

Side A fixes a substantive correctness issue by removing shared browser sentinel delegates, changing pending sessions to use an optional delegate for browser logins, updating attribution logic, and adding integration tests that verify multiple human users can vote without erroneous shared AgentBound conflicts. Side B only makes minor UI cleanup by removing or relocating headings and help text in the compose view, with no evident behavioral improvement.

Side B fixes a real multi-user bug (shared browser sentinel delegate blocking all but the first human voter) with a targeted change plus a new regression test proving two distinct users can vote; this is a genuine correctness fix with lasting value. Side A is a large but purely cosmetic CLI restructuring (renaming ingest to forum post, reshuffling subcommands and docs) that touches many files without fixing any bug or adding real functionality.

B fixes a real multi-user breakage: shared WEB_BROWSER_AGENT/INVITE sentinels bound on first browser vote and blocked later humans; posts now use Option<delegate>/None with attribution and a two-user vote regression test. A mostly reshapes CLI surface (ingest→forum post, forum list/show) and docs/tests without that class of correctness win.

Side B fixes a substantive multi-user authentication/ownership bug by removing shared browser sentinel delegates, changing pending sessions to use an optional delegate, updating UI posting to send no delegate for browser users, and adding an integration test proving two different human users can both vote successfully without creating incorrect agent bindings. Side A is largely a CLI/API reorganization and documentation refresh (renaming `ingest` into `forum post`, restructuring subcommands, updating help text and tests), which improves usability but is primarily an interface reshaping rather than a core correctness improvement.

Side B fixes a real concurrency/correctness bug (a shared sentinel delegate blocking multi-user votes) with a coherent refactor (Option<String> agent), updated tests including a new integration test proving the fix, and cleanup of now-dead sentinel logic across CLI/server/types. Side A also adds real value (HTML sanitization to prevent XSS) but its diff is dominated by a large generated Cargo.lock dependency tree, and the actual logic change is a small, straightforward wrapper function with modest test coverage.

B fixes a core multi-user breakage by removing shared browser sentinel delegates (WEB_BROWSER_AGENT/INVITE_BROWSER_AGENT) and modeling PendingSession.agent as Option so human votes no longer AgentBind a single fake delegate; it updates auth, UI posts, authorship, types/CLI poll handling, and adds a two-user integration test. A is a real, lasting XSS harden (ammonia at render for body_html with unit tests) but is a narrower sanitize-at-boundary change versus B’s correct data-model and product-path fix.

Side A closes a significant security gap by sanitizing untrusted Reddit `body_html` with `ammonia` before passing it to `maud::PreEscaped`, adds a dedicated sanitizer module, and includes tests verifying scripts and event handlers are stripped while benign markup is preserved. Side B fixes an important browser-auth design bug by removing shared sentinel delegates, switching browser sessions to `None` delegates, and adding strong integration tests for multi-user voting, but its impact is narrower than preventing XSS in rendered content.

Commit A fixes a real correctness bug (shared sentinel delegate blocking multi-user voting), removes dead/misleading abstractions cleanly, and adds a solid integration test proving two distinct users can vote without collision. Commit B is also a legitimate bugfix (avoiding blocked public Reddit API, forcing OAuth refresh) with good error-detail handling and a unit test, but it's a narrower operational fix versus A's core multi-user correctness fix affecting fundamental voting functionality.

Commit A removes the shared WEB_BROWSER_AGENT/invite sentinel design that bound AgentBound on the first browser vote and blocked later humans, making delegate Optional end-to-end (auth, PendingSession, UI posts, authorship, poll types) with a multi-user vote integration test—lasting core product correctness. Commit B is a solid production fix (mandatory OAuth when creds exist, 401/403 refresh, no public www fallback, fly.toml base URL) but is narrower operational resilience for the Reddit worker rather than a foundational multi-user model fix.

Side A removes the shared browser sentinel delegate by changing pending sessions and browser posts to use `Option<String>` delegates, eliminating a design flaw where one shared delegate caused later human votes to fail (`delegate already bound`). It also updates attribution logic and adds a comprehensive integration test verifying multiple browser users can vote independently, whereas Side B improves Reddit OAuth robustness with required OAuth, token refresh on 401/403, and clearer error handling but is confined to a specific integration path.

Side B fixes a real concurrency bug (shared sentinel delegate causing 'delegate already bound' failures that silently blocked every human user after the first vote), with a targeted type-level fix (Option<String> for agent), removal of now-dead sentinel logic, and a concrete regression test proving multi-user voting works. Side A is a large infra/UI deployment commit (Dockerfile, fly.toml, dashboard, SSE audit feed) that adds real operational value but is mostly additive scaffolding and cosmetic dashboarding rather than fixing a functional defect.

A ships lasting production infrastructure (Dockerfile, fly.toml, main-branch test-and-deploy CI), wires real repo/contributor roots and GitHub auth, and adds an auditable /watch SSE progress API with tests and epoch failure retry—operationalizing the constitution system end-to-end. B is a precise, high-leverage correctness fix (optional agent, drop shared WEB_BROWSER_AGENT so multi-user browser votes no longer hit AgentBound), but it is narrower in scope than A’s deployable runtime and observability surface.

Side B fixes a concrete correctness issue by removing shared browser sentinel delegates, changing pending sessions to use an optional delegate for browser logins, and ensuring browser-authored actions no longer create incorrect agent bindings that blocked multiple human users. Side A adds valuable deployment infrastructure, monitoring UI, SSE audit streaming, and production configuration, but it also bundles a large amount of operational and UI work whose long-term value is broader rather than addressing a core correctness bug; B's focused behavioral fix is more fundamental and is backed by integration tests covering the multi-user voting scenario.

Side A is a large but purely mechanical/incomplete refactor (RPC batch API, room scoping) with no evidence it compiles cleanly end-to-end in this diff (e.g. missing imports, unused fields), representing churn/rearchitecture rather than a targeted fix. Side B fixes a real, concrete multi-user bug (a shared sentinel AgentBound delegate blocking all but the first human voter), removes the buggy sentinel mechanism cleanly across CLI/server/types, and adds a targeted regression test proving the fix, making it a smaller but more clearly correct and valuable change.

Commit A delivers a lasting architectural redesign: collapsing the scattered REST handlers (garden/forum/ingest/rank/etc.) into a single room-scoped RPC batch surface, splitting threads from permission rooms in the reducer/events model (ScopeId::Room, room_id+thread_tag on Ingest, forum_threads/ingests_by_scope_thread), and updating CLI + tests accordingly. Commit B is a correct and necessary but narrow bugfix that drops fake browser sentinel delegates so AgentBound no longer blocks subsequent human voters.

Side A introduces a substantial architectural change: it replaces many individual REST endpoints with a unified batched RPC interface, restructures the CLI around room-scoped commands, separates room and thread concepts in the event/reducer model, and updates validation, routing, tests, and data structures to support the new design. Side B fixes a real multi-user bug by removing browser sentinel delegates so browser-originated posts no longer create conflicting AgentBound entries, but it is a targeted correctness fix compared with Side A's broader, lasting platform restructuring.

Side A fixes a concrete, high-impact bug (shared sentinel delegate blocking all but the first human voter) with a clean design change (Option<String> instead of sentinel constants) and adds a targeted integration test proving multi-user voting now works. Side B is a broader refactor (async settlement worker, score caching, removing demo-counter code) that is plausible but riskier, less clearly motivated ('nice' commit message), and not tied to a demonstrated user-facing bug.

A fixes a real multi-user correctness bug by replacing shared WEB_BROWSER_AGENT/INVITE_BROWSER_AGENT sentinels with Option<String> agent=None for browser posts, so votes no longer hit shared AgentBound; it includes a focused integration test that two humans can both vote without delegates. B mixes useful settlement/ranking-cache infrastructure with largely non-lasting demo-counter scaffold removal, so less of the diff is durable product correctness.

Side A fixes a substantive correctness issue by replacing shared browser sentinel delegates with an optional delegate, preventing browser users from sharing a single agent identity that blocked subsequent human votes. It updates session types, authentication flow, UI attribution, CLI polling, and adds an integration test verifying two different browser users can both vote successfully without creating agent bindings. Side B contains useful cleanup and architectural work (removing the demo counter and introducing cached ranking/settlement infrastructure), but much of it is refactoring and optimization without demonstrating a comparable user-facing bug fix.

A fixes a genuine auth bypass (mock_user OAuth was previously unguarded, letting anyone log in as any GitHub identity) and makes vote-actor resolution fail-closed instead of silently falling back to anonymous, plus pins the durable dependency by rev and adds Secure cookie flags and open-redirect hardening — all backed by new unit tests. B fixes a real but narrower bug (a shared browser delegate blocking concurrent human votes) with a good regression test, but its scope and security impact are smaller than the auth-bypass and fail-closed fixes in A.

B fixes a core multi-user breakage: a shared WEB_BROWSER_AGENT sentinel bound on the first browser vote and blocked later humans with AgentBound, by making PendingSession.agent optional and posting browser votes with no delegate, plus a two-user integration test. A’s fail-closed resolve_vote_actor, mock-OAuth gate, Secure cookies, and return_to hardening are real security wins, but they refine an existing auth path rather than removing a flawed design that stopped the product’s main multi-user flow.

Side A delivers several lasting security and correctness improvements: voting now fails closed instead of silently falling back to an anonymous actor, auth cookies gain conditional Secure handling, OAuth mock login is gated behind an environment flag, open-redirect sanitization is tightened, and the external `durable` dependency is pinned by immutable revision. Side B fixes an important multi-user bug by removing shared browser sentinel delegates and updating the session model/tests so browser users have no delegate, but its scope is narrower than A's combination of security hardening, authentication correctness, and reproducibility improvements.

Side A fixes a real, well-documented multi-user bug (shared browser sentinel delegate blocking concurrent human votes) with a minimal, coherent diff, clear tests validating the fix, and cleanup of now-dead sentinel logic. Side B, despite being labeled 'refactor,' is a much larger, unrelated feature bundle (new pair-suggestion algorithm, new vote.rs page, ItemId::from_storage normalization, Clojure test harness refactor) that is broader and less focused, making it harder to verify as a clean, necessary unit of ownership even though it adds substantial functionality.

B lands lasting product surface: a full /vote compare page, idiomorph edge-history refresh, and a bridge-preferring pair-selection algorithm in new pair.rs/vote.rs with normalization via ItemId::from_storage—core ranking UX, not churn. A is a precise, well-tested fix (drop shared WEB_BROWSER_AGENT sentinels so multi-user browser votes no longer hit AgentBound), but it is narrower correctness surgery around Optional agents rather than new ranking capability.

Side A fixes a substantive correctness bug by removing shared browser sentinel delegates, changing pending sessions to use an optional delegate, updating attribution logic, and adding integration tests proving multiple browser users can vote independently without erroneous AgentBound conflicts. Side B introduces a substantial new vote-compare UI flow and related refactoring, but much of it is feature work and infrastructure rather than resolving an existing correctness issue, making A's bugfix more durable and fundamental.

Side A fixes a concrete, real multi-user bug (shared sentinel delegate blocking subsequent human voters), threading an Option<String> change through types/server/tests with a targeted regression test proving the fix. Side B ('nice') is a larger feature addition (Reddit entity import as explicit user action, dotenv support) that is plausible and tested but less clearly a necessary fix and includes more speculative/broad refactoring (event schema changes, new config plumbing) with higher risk of churn for uncertain payoff.

A fixes a real multi-user correctness bug by removing shared browser sentinel delegates (WEB_BROWSER_AGENT/INVITE_BROWSER_AGENT), making PendingSession.agent Option, posting UI votes with no delegate, and proving two humans can vote without AgentBound—lasting auth/authorship model cleanup with targeted tests. B is a larger Reddit import redesign (EntityImported payloads, explicit fetch UI, config/dotenv) with real value, but more feature surface than the critical shared-delegate voting failure A resolves.

Side A fixes a concrete correctness issue by replacing shared browser sentinel delegates with `None` for web sessions, updating pending-session types to `Option<String>`, and adjusting attribution logic so browser users no longer collide on a shared delegate. It also adds an integration test proving two different browser users can both vote successfully without creating `AgentBound` entries, whereas Side B is a broader feature addition (manual Reddit fetching, persisted entity imports, dotenv support) whose value is less directly tied to fixing an existing correctness problem.

Side B fixes a real, user-visible multi-user bug (shared sentinel delegate blocking subsequent human votes) with a targeted change, new integration test, and updated docs/types, delivering concrete correctness value. Side A is a large mechanical rename (CanonicalItemUrl -> ItemId) plus deletion of a planning doc; while structurally reasonable, it's mostly churn/refactor with no new capability or bugfix and carries risk (fallback opaque() bypassing normalization) without demonstrated necessity beyond the refactor's own stated goals.

B fixes a concrete multi-user correctness bug: shared WEB_BROWSER_AGENT/INVITE sentinels caused AgentBound on the first browser vote and blocked later humans; making PendingSession.agent optional and posting UI votes with no delegate (plus integration coverage) restores real multi-user voting. A is a broad CanonicalItemUrl→ItemId migration with lasting type structure, but much of the diff is mechanical renames/propagation and string-backed Local/Web/Opaque keys rather than higher product impact.

Side A replaces the pervasive `CanonicalItemUrl` string wrapper with a structural `ItemId` type, introduces dedicated `item_id`/`item_wire` modules, and propagates the new identity model through reducers, routing, ranking, APIs, and tests, creating a more durable foundation for item identity and URL handling. Side B fixes a real multi-user bug by removing shared browser sentinel delegates and updating session/auth flows and tests, but its impact is narrower than the cross-cutting architectural improvement in Side A.

Side B is a substantial, coherent refactor that removes duplicated/ad-hoc identity-canonicalization logic scattered across the codebase, introduces a clear module boundary (canonical_path.rs, identity.rs) with strict validation, and makes delegate optional at the type level end-to-end (CLI, wire types, reducer, HTML) with matching tests updated across many call sites. Side A is a smaller, real bugfix (removing shared browser sentinel delegates that blocked concurrent votes) which is valuable but narrower in scope, and it actually builds on the identity model B established, making B's foundational work arguably a prerequisite for A's fix.

B is a lasting identity redesign: optional naked delegates, strict no-@ wire form, identity/canonical_path split, and a reducer that stops rewriting principals—foundational across ingest, APIs, CLI, and HTML. A is a high-value but narrower follow-on bugfix (drop shared WEB_BROWSER_AGENT sentinels, Option agent on pending sessions, multi-user vote test) that depends on that model rather than establishing it.

Side A fixes a concrete correctness bug by replacing shared browser sentinel delegates with `None` for web sessions, preventing erroneous `AgentBound` collisions so multiple human users can vote independently. It updates the pending-session model, HTML attribution, CLI polling, and adds an end-to-end integration test verifying two different browser users can vote without creating delegate bindings, whereas Side B is primarily a broad refactor of identity/canonicalization and API conventions with comparatively less direct functional impact.

Side A vendors an entire speculative RocksDB-backed collections crate (with docs, examples, benches, vast Cargo.lock churn) mainly to move Reddit JSON out of memory, adding large maintenance surface for a modest, somewhat premature startup-RAM optimization. Side B is a small, focused bugfix that removes shared sentinel delegate IDs which were silently corrupting multi-user authorship/voting (AgentBound collisions), with clear tests proving the real bug and its fix, delivering concrete correctness value with minimal footprint.

Side A introduces a real architectural win: vendoring a RocksDB-backed durable crate, moving Reddit entity JSON off the in-memory GlobalTree into entity_db, and streaming events.jsonl line-by-line so startup no longer loads the full log. Side B is a necessary but narrow correctness fix—dropping shared WEB_BROWSER_AGENT/INVITE sentinels so multi-user browser votes no longer collide on AgentBound—without comparable lasting systems impact.

Side A makes a substantial architectural change: it introduces a new RocksDB-backed `durable` workspace crate, moves raw Reddit entity JSON out of in-memory state into a persistent `EntityStore`, and replaces full event-log loading with streaming replay to reduce startup memory usage. Side B fixes a real correctness bug by removing shared browser sentinel delegates (changing browser sessions to use `Option<String>` delegates and adding integration tests), but its impact is much narrower than A's persistent storage and replay redesign.

A fixes a severe, user-facing bug: a shared sentinel delegate bound on first vote silently blocked every subsequent human voter, breaking core multi-user functionality; the change is minimal, clearly scoped (Option<String> agent), removes dead sentinel code, and is verified by a concrete two-user vote test. B is also solid—refactoring duplicated feed logic into one function and fixing subtle same-millisecond/clock-rollback ordering plus permission-anchor edge cases—but the bug it fixes is rarer and less catastrophic than A's outright feature-breaking defect.

B replaces fragile timestamp cutoffs with durable ingest-order anchors and correct permission filtering in rpc_feed, fixing missed concurrent posts, clock-rollback gaps, and private-room leaks (including room on FeedPost). A is a real multi-user vote fix by dropping shared browser sentinel delegates for Option::None, but it is a narrower auth/UI binding cleanup than B’s core feed correctness and visibility hardening.

Side B refactors feed generation into a shared `rpc_feed` path and fixes a subtle correctness issue by anchoring implicit catch-up to durable ingest order instead of timestamps, while also enforcing visibility filtering and exposing room metadata in feed responses. Its integration tests cover timestamp collisions and private-room permission changes, whereas Side A primarily removes browser sentinel delegates by making pending-session agents optional to fix multi-user browser voting and simplify attribution.

Side B fixes a real concurrency/correctness bug (a shared sentinel delegate binding on first vote silently blocked every other human voter) with a minimal, well-targeted change plus a multi-user regression test proving the fix. Side A adds substantial new feature surface (GitHub import cards, resolver module split, external-root fix) which is valuable but larger/noisier and mostly additive feature work rather than a critical correctness fix; B's change prevents active user-facing breakage, giving it slightly more lasting value per line changed.

B fixes a core multi-user correctness bug: shared WEB_BROWSER_AGENT/INVITE_BROWSER_AGENT caused AgentBound on first browser vote and blocked every later human; PendingSession.agent becomes Option, UI posts pass no delegate, and a two-user vote integration test locks it in. A’s /- external-root fix and GitHub card/resolvers work are real lasting value, but much of the patch is a module move plus richer import UI, which matters less than unblocking multi-user voting.

Side A fixes a real functional bug where the external garden index (`/-/`) appeared empty by introducing `external_root_host_items`, and it also adds a durable resolver architecture (`server/src/resolvers/`) with GitHub import-card storage/rendering, integration into item rendering, and accompanying tests. Side B is a valuable correctness fix—removing browser sentinel delegates so browser users no longer share a delegate and multi-user voting works correctly—but it is a narrower authentication/data-model change centered on making browser sessions use `None` delegates and updating attribution and tests.