c_25ece8f92dc846b003

Side B fixes a real multi-user concurrency bug (shared sentinel delegate blocking subsequent human voters) with a coherent type-level fix (agent becomes Option<String>), updates all call sites, and adds a substantial regression test proving the fix. Side A is purely cosmetic UI markup cleanup (removing labels/toggle buttons and changing placeholder text) with no functional impact.

B fixes a real multi-user bug by removing shared browser sentinel agents (WEB_BROWSER_AGENT/INVITE_BROWSER_AGENT), making PendingSession.agent optional, and stopping UI votes/posts from binding a delegate—backed by integration tests for two humans voting successfully. A only trims forum compose markup (toggle, labels, JSON error targets) and rewords placeholders, a cosmetic UI churn with little lasting design impact.

Side B fixes a substantive authentication/delegate design bug by changing browser sessions from a shared sentinel agent to `None`, updating `PendingSession` and polling types to use `Option<String>`, and removing the browser delegate from UI posts so multiple human users can vote without conflicting `AgentBound` state. It also adds integration tests covering the multi-user voting scenario and browser login behavior, whereas Side A mainly removes UI toggle/labels and changes placeholder text and button wording with little lasting functional impact.

Both patches implement the same core fix (drop shared sentinel delegates so multi-user votes work) with identical new tests, but B goes further and cleans up all the now-dead sentinel machinery: it removes the unused `is_browser_sentinel_delegate` helper and its `mod.rs` re-export, simplifies `authorship_attr`/`authorship_color_seed` in `html/mod.rs` to drop sentinel-checking branches, and deletes the now-obsolete `browser_sentinel_delegate_shows_username` test. A leaves this related dead code and tests untouched, so B's diff represents a more complete and consistent refactor with less leftover cruft.

Both commits implement the same core fix (Optional agent, drop shared WEB_BROWSER_AGENT/INVITE sentinels, multi-user vote test). B adds lasting cleanup Side A omits: deleting is_browser_sentinel_delegate, simplifying authorship_color_seed/authorship_attr in html/mod.rs to None-vs-Some, and removing related exports and sentinel unit tests.

Both commits implement the core fix by changing pending sessions and poll responses to use `Option<String>` for delegates, removing browser sentinel delegates, updating UI posts to pass `None`, and adding an integration test proving two browser users can vote without `AgentBound` conflicts. Side B goes further by removing the obsolete browser-sentinel attribution logic (`is_browser_sentinel_delegate`, related re-exports, and HTML rendering/tests), simplifying authorship handling so the codebase consistently treats browser users as having no delegate rather than preserving legacy sentinel behavior.

Side B fixes a real concurrency bug where a shared sentinel delegate blocked every human user after the first browser vote, with a targeted multi-file fix and a new integration test proving two users can vote independently. Side A adds a genuinely useful feature (pool-scoped voting) but is purely additive UI/UX without addressing any correctness defect, making B's change more critical to actual product correctness.

B fixes a core multi-user correctness bug: shared WEB_BROWSER_AGENT/INVITE_BROWSER_AGENT sentinels caused AgentBound on the first browser vote and blocked later humans; making PendingSession.agent optional and posting votes with no delegate restores real multi-user voting, backed by an integration test of two principals. A is a solid product feature (pool query, child pair picking, nav threading, UI button) but builds on voting rather than unblocking it.

Side B fixes a fundamental authentication/ownership bug by removing the shared browser sentinel delegate, changing pending sessions to carry an optional agent, ensuring browser-originated writes use no delegate, and adding integration tests proving two different users can both vote without erroneous delegate binding. Side A adds a useful pool-scoped voting workflow with new routing, navigation, and UI links, but it is primarily a feature addition rather than a correctness fix affecting all browser users.

Side A fixes a real multi-user correctness bug (shared sentinel delegate blocking subsequent voters) with a broad, coherent change across CLI, server, types, and tests, including a targeted integration test proving the fix. Side B is a smaller, valid reducer fix (moving a zero-ratio guard earlier to avoid ghost items), which is correct but narrower in scope and impact than A's fix to a user-facing multi-tenant blocker.

A fixes a real multi-user blocker: shared WEB_BROWSER_AGENT sentinels bound on first browser vote and rejected later humans; making PendingSession.agent optional and posting UI votes with no delegate restores correct multi-user behavior and is backed by a full integration test. B is a correct but narrower reducer fix that only reorders the zero-ratio early-return so ensure_item/voted_pairs do not leave ghosts—valuable hygiene, smaller lasting scope than A.

Side A fixes a user-facing design flaw by removing shared sentinel browser delegates, changing pending sessions and browser posts to use no delegate, updating API types to `Option<String>`, and adding an integration test proving multiple human users can vote without conflicting `AgentBound` state. Side B is a good reducer bugfix that moves the zero-ratio guard before `ensure_item` and `voted_pairs` mutations to prevent ghost state, but it is narrower in scope and impact than the cross-cutting authentication and voting correctness fix in Side A.

Side B fixes a genuine multi-user correctness bug (a shared sentinel delegate wrongly binding and blocking subsequent human voters) with a clean type-level fix (agent: Option<String>) plus a targeted regression test proving two distinct users can vote without collision. Side A also fixes a real reliability issue (OAuth fallback hitting Reddit's block page) with reasonable retry/error-detail handling, but it's a narrower infra fix with less systemic impact than B's multi-tenant correctness fix, and B's change is verified end-to-end across CLI, server, and types.

B fixes a core multi-user correctness bug: a shared WEB_BROWSER_AGENT sentinel bound on first vote and blocked later humans with AgentBound; making PendingSession.agent Option and posting with no delegate restores proper human votes, with a solid two-user integration test. A is a strong production fix (require OAuth when creds exist, refresh on 401/403, stop falling back to the blocked www.reddit.com path), but it is scoped to one external integration plus a fly.toml pin, whereas B corrects the app’s auth/delegate model end-to-end.

Side A strengthens Reddit integration by making OAuth mandatory when credentials exist, adding automatic token refresh and retry on 401/403 responses, propagating token acquisition errors instead of silently falling back, and improving diagnostics with truncated error messages plus a regression test. Side B fixes an important multi-user browser voting bug by removing shared sentinel delegates and updating session types and tests, but its scope is more localized compared with A's broader resilience and correctness improvements to external API handling.

B delivers substantial new functionality (pairwise vote UI with bridge-based pair selection algorithm, edge-history morphing, ItemId normalization for reddit URLs) plus real test infra reuse (extracted mock-reddit helper) and new integration/e2e tests. A is a smaller but genuinely important bugfix (removing a shared sentinel delegate that blocked concurrent human votes) with good targeted tests, but is narrower in scope and lasting impact compared to B's broader feature and architecture contribution.

B adds lasting core product design: bridge-preferring pair selection in pair.rs, a dedicated vote compare UI with in-place morphs (vote_recorded_morph), and durable ItemId::from_storage normalization with tests—not mere churn. A is a high-value correctness fix (optional agent, drop shared WEB_BROWSER_AGENT so multi-user browser votes no longer hit AgentBound), but narrower in scope than B’s voting infrastructure.

Side B adds substantial new functionality and architecture: a dedicated pair-selection module with bridge-aware ranking logic, a new vote comparison UI that updates edge history in place, canonical item normalization via `ItemId::from_storage`, and supporting tests and utilities. Side A delivers an important targeted bug fix by replacing browser sentinel delegates with `None` to prevent shared delegate collisions for human votes, but its scope is narrower despite being well-tested and impactful.

Side A fixes a real concurrency bug (shared sentinel delegate blocking multi-user votes) with a minimal, well-targeted change plus a direct regression test proving the fix. Side B is a large URL-encoding refactor (dropping the '/' between room short-id and slug) that changes external URL identity/canonicalization behavior broadly, touches many call sites and tests, and bundles in unrelated YouTube URL normalization logic, increasing risk and surface area without a clearly motivated bug being fixed.

A fixes a real multi-user failure: shared WEB_BROWSER_AGENT sentinels bound on first browser vote and blocked later humans, replaced by Option<agent>/None delegates with a focused regression test for two users voting. B mainly renames room HTTP paths (/r/short/slug → /r/{short}{slug}), centralizes that encoding, and adds URL identity helpers—useful structure, but largely route churn and niceties versus A’s correctness fix.

Side A fixes a concrete correctness bug by removing shared browser sentinel delegates, changing pending sessions to carry an optional agent, ensuring browser actions use no delegate, and adding an integration test proving two different browser users can both vote without hitting the shared `AgentBound` failure. Side B is primarily a broad URL/route refactor and normalization effort (new room route encoding, URL helpers, and canonicalization), which may improve consistency but is largely structural compared with A's targeted functional bug fix backed by regression tests.

Side B fixes a real concurrency bug (shared sentinel delegate blocking multi-user votes) with a proper type-level fix (Option<String>), adds a targeted regression test proving two distinct users can vote without collision, and updates related call sites/tests coherently. Side A adds a genuine security improvement (HTML sanitization) but the diff is dominated by a huge, uninteresting Cargo.lock dependency tree; the actual code change is small but valuable, while Side B's fix addresses a more fundamental correctness bug affecting core multi-user functionality with better test coverage.

B fixes a core multi-user blocker by making PendingSession.agent Option<String>, dropping shared WEB_BROWSER_AGENT/INVITE_BROWSER_AGENT sentinels that caused AgentBound collisions on later human votes, and adding an integration test proving two users can both vote with no delegate. A is a solid, localized XSS hardening (ammonia + entity_body_html at two PreEscaped sites with unit tests) but does not alter foundational auth or collaboration behavior.

Side A introduces a targeted security improvement by sanitizing untrusted Reddit `body_html` with `ammonia` before every `PreEscaped` render, adds a dedicated sanitization module, and includes tests that verify scripts and event handlers are stripped while benign markup is preserved. Side B fixes an important correctness issue by removing the shared browser delegate sentinel and updating session types and tests so multiple browser users can vote independently, but the XSS mitigation in A provides broader, long-term protection across all rendered Reddit content.

Side A fixes a genuine multi-user bug (shared sentinel delegate blocking all-but-first browser voter) with a minimal, well-tested schema/type change (Option<String> agent) plus a substantial new integration test proving the fix; Side B adds a large speculative Reddit-fetch worker feature with no tests exercised against real behavior beyond unit URL-mapping tests, and includes a stray 'todo' file and unrelated .env ignore, making it more exploratory/incomplete than a solid bugfix. Side A's change is smaller, precise, and directly resolves a concrete correctness issue affecting real usage, giving it more lasting value despite Side B's larger code volume.

A fixes a real multi-user correctness bug by removing shared browser sentinel delegates (WEB_BROWSER_AGENT/INVITE_BROWSER_AGENT), making PendingSession.agent optional end-to-end, and proving two humans can vote without AgentBound collisions via solid integration tests. B adds substantial Reddit fetch infrastructure (broker, OAuth, rate-limit backoff, JSON mapping), but it is still an incomplete integration surface (plus todo/.gitignore noise) rather than a core multi-user correctness repair.

Side A fixes a concrete correctness bug by removing shared browser sentinel delegates, changing pending sessions to carry an optional delegate only for CLI flows, updating UI posts to use no delegate, and adding integration tests proving two browser users can vote independently without creating erroneous AgentBound entries. Side B adds a large Reddit import framework with background fetching, OAuth, and parsing, but it is a new feature with substantial unproven complexity and no evidence of fixing an existing project-wide correctness issue comparable to A's tested bugfix.

B fixes a concrete production bug (shared sentinel delegate blocking multi-user voting) with a targeted, well-tested change including a regression test proving two users can vote independently. A is a larger refactor (splitting identity/canonical_path modules, dropping @ from wire format) that improves clarity but is mostly reorganization/renaming without fixing a live user-facing defect, and its scope makes correctness harder to fully verify despite the added tests.

B fixes a concrete production bug: shared WEB_BROWSER_AGENT/INVITE_BROWSER_AGENT sentinels caused AgentBound on the first browser vote and blocked every later human, and it removes those sentinels so UI posts use delegate None with a multi-user regression test. A is a large identity/path split (canonical_path + identity, strict no-@ wire form, optional delegate, reducer stops rewriting) that improves lasting design and enables optional delegates, but much of the diff is mechanical call-site/test churn versus B’s narrower correctness win.

Side A introduces a durable architectural separation by extracting identity parsing (`identity.rs`) and path normalization (`canonical_path.rs`), removing implicit identity rewriting from the reducer, changing delegates to `Option<String>`, and enforcing strict stored-form identities across APIs while keeping HTML-specific `@` rendering. Side B fixes a real multi-user bug by eliminating shared browser sentinel delegates and adding strong regression tests, but it is a focused follow-up built on the broader identity model established in Side A.

Side A fixes a genuine multi-user correctness bug (shared sentinel delegate silently locking out other human voters) with a minimal, well-scoped change plus a targeted regression test proving the fix. Side B also fixes a real bug (inconsistent canonical root path causing lookup mismatches) but does so with a much larger, more invasive refactor across path types touching many call sites, which carries more risk despite good test coverage; both are solid but A's fix is more surgical and addresses a more severe functional defect (broken voting) with lower blast radius.

A removes false shared browser agent sentinels and models PendingSession.agent as Option, fixing multi-user votes blocked by AgentBound and aligning browser posts with real no-delegate humans; B mainly unifies tilde-root URL spellings and lookup normalization. A’s identity/delegate design change is the sharper, more product-critical correctness fix, while B is important path hygiene with more surface/tests but narrower lasting model impact.

Side B consolidates canonical path handling by introducing shared helpers (`tilde_http_path_to_canonical`, normalized ontology-root storage) and updates ranking, breadcrumb, and garden code to use normalized keys, fixing root-path inconsistencies and adding broad regression coverage. Side A correctly removes browser sentinel delegates by making pending-session agents optional and prevents shared delegate binding for browser users, but its scope is narrower than B's cross-cutting path normalization and routing improvements.

B fixes a real, concrete multi-user bug (a shared sentinel delegate causing 'AgentBound' collisions that blocked votes from a second human), verified with a targeted integration test proving two distinct users can now vote. A adds genuine security hardening (fail-closed auth, Secure cookies, open-redirect fixes) which is valuable, but it also mixes in unrelated cosmetic nav changes and a dependency pin tweak, diluting its focus; both are solid, but B's fix addresses a functional correctness bug with clear before/after proof.

B fixes a core correctness bug: a shared WEB_BROWSER_AGENT sentinel bound on the first browser vote and blocked every later human with AgentBound; making PendingSession.agent optional and posting votes with no delegate restores multi-user voting, with a direct two-user integration test. A’s fail-closed sessions, mock-OAuth gate, Secure cookies, and open-redirect hardening are real lasting security work, but they are layered controls and UX around auth rather than unblocking the product’s primary multi-user path.

Side A makes several durable security and correctness improvements: voting now fails closed instead of silently falling back to an anonymous actor, auth cookies gain the Secure flag when appropriate, OAuth mocking is gated behind an environment flag, open-redirect sanitization is strengthened with tests, and the durable dependency is pinned by revision for reproducible builds. Side B fixes a real multi-user bug by removing shared browser delegate sentinels and updating pending-session handling and tests, but its scope is narrower than the broader authentication hardening and security improvements in Side A.