c_94135a1c4c580e8ca9

Side B fixes a real security flaw (votes silently falling back to an anonymous actor instead of failing closed when unauthenticated), gates a test-only OAuth bypass behind an explicit env var, adds Secure cookie support and open-redirect hardening with tests, and pins a git dependency by immutable rev instead of a mutable branch — all substantive, lasting improvements. Side A is a correct but narrow bugfix (moving a guard before side effects) with a single test update, valuable but much smaller in scope and impact.

B hardens the auth model (fail-closed vote actor, mock OAuth gate, Secure cookies, tighter return_to sanitization) plus dependency pinning and session-aware nav—broad, lasting security and product design. A is a correct, precise reducer bugfix that drops zero-ratio votes before ensure_item/voted_pairs side effects, but its scope is a single narrow data-integrity edge case.

Side B introduces substantive security hardening across the authentication flow: vote submission now fails closed when no valid session exists, mock OAuth is gated behind an explicit environment flag, Secure cookie attributes are enabled for HTTPS deployments, and return-path sanitization is strengthened with accompanying tests. Side A fixes a real reducer bug by moving the zero-ratio early return ahead of `ensure_item` and `voted_pairs` registration to prevent ghost items and stale voted pairs, but its impact is narrower than the broader authentication and security improvements in Side B.

Side A delivers a coherent, security-focused change (fail-closed vote auth, mock-OAuth gating, Secure cookies, open-redirect hardening) with tests and doc updates, directly closing real vulnerabilities. Side B is a large architectural rewrite (scope->fractal tree/ItemId) that is plausible but riskier, less focused, and its terse 'reconfigure' message and broad renames (settlement->journal, groups->tree) suggest unreviewed churn without the same clear safety payoff.

B replaces flat scope maps with a hierarchical ItemId/GlobalTree model (path canonicalization, breadcrumbs, journaled tree votes, NodeEnsured), which is lasting core-domain design. A’s fail-closed voting, mock-OAuth gate, Secure cookies, and open-redirect hardening are real security fixes, but they tighten an existing auth layer rather than reshaping the ranking architecture.

Side A delivers concrete security and correctness improvements: voting now fails closed instead of silently falling back to an anonymous actor, auth cookies gain the Secure flag when appropriate, mock OAuth is gated behind an environment flag, open-redirect sanitization is strengthened, and these behaviors are covered by new tests. Side B is a broad architectural refactor toward hierarchical ItemId/tree support, breadcrumbs, and a journal rename, but much of it lays infrastructure or UI changes rather than fixing an immediate correctness or security issue, making A the more durable high-impact change.

B fixes a real security bug (voting silently fell back to an anonymous shared actor on session failure, letting unauthenticated or expired-session requests record votes as a default identity) with fail-closed error handling, adds Secure-cookie support, gates a test-only mock OAuth path behind an env flag, and hardens open-redirect sanitization with tests. A is a solid, well-scoped reliability fix for Reddit OAuth fallback/retry with good error truncation and tests, but its scope is narrower and addresses an operational/API-blocking issue rather than a security-integrity flaw.

B hardens core product invariants: fail-closed vote auth (no anon fallback), Secure cookies driven by BASE_URL, mock-OAuth gated behind an env flag, and tighter return_to open-redirect checks, plus durable pinned by rev. A is a strong, focused production fix (require OAuth when creds exist, refresh on 401/403, clearer block-page errors) but is localized to the Reddit fetch path and a fly.toml env pin, so it carries less lasting cross-app weight than B’s auth/security design.

Side B hardens core authentication behavior by making vote attribution fail closed instead of silently falling back to an anonymous actor, adding Secure cookie handling based on HTTPS, tightening return URL validation against open redirects, and gating mock OAuth behind an explicit environment flag, with accompanying tests. Side A provides a valuable Reddit integration fix by requiring OAuth when configured, retrying after 401/403 with token refresh, and improving error handling, but its impact is narrower than the broader security and authentication improvements in Side B.

Side A vendors a large, mostly generated durable/ crate (docs, examples, lockfiles) and swaps entity storage to RocksDB, but this was later superseded by pinning durable as an external git dep in Side B, making much of A's vendored code and its own Cargo.lock churn transient scaffolding. Side B fixes a real security bug (votes silently falling back to an anonymous actor instead of failing closed), gates a mock-OAuth backdoor behind an explicit test-only env var, adds Secure cookie flags and open-redirect hardening, and pins the durable dependency to an immutable rev rather than a floating branch — all small, precise, and durable improvements to correctness and security posture.

A delivers lasting core architecture: entity JSON moves out of GlobalTree into RocksDB via EntityStore, event log replay streams line-by-line (cutting startup RAM), and apply_entity paths stop retaining full payloads in memory. B is high-value but narrower—fail-closed vote auth, mock-OAuth gating, Secure cookies, return-to hardening, and nav alias—important security/UX fixes that do not reshape the data plane like A.

Side A introduces substantial infrastructure: a new RocksDB-backed `durable` workspace crate, moves raw Reddit entity JSON out of the in-memory tree into an `EntityStore`, and replaces startup loading with line-by-line event log replay to reduce memory usage while updating reducers and tests accordingly. Side B improves security by making vote authentication fail closed, adding Secure-cookie handling, redirect sanitization, and pinning a dependency revision, but these are comparatively localized hardening changes rather than a broad architectural improvement.

Side A fixes real security gaps (fail-closed vote actor resolution instead of silent anon fallback, gating mock OAuth behind an env flag, Secure cookie support, stricter open-redirect sanitization) plus adds useful nav UX, all backed by targeted unit tests. Side B is a substantial but purely cosmetic URL-format refactor (collapsing room short/slug into one path segment) bundled with an unrelated, large speculative URL-identity normalization module and many exploratory tests documenting url::Url hashing behavior, which adds bulk without clear necessity or lasting security/correctness value.

A delivers lasting security/correctness: fail-closed vote actors (no anon fallback), production mock-OAuth gating, Secure cookies, and tighter return-to sanitization, plus session-aware nav—core integrity for voting. B’s room-path consolidation and YouTube/query URL normalization are real design wins and better DRY, but a large share is mechanical route/shape churn across handlers and tests, so it trails on necessity per line.

Side A delivers substantive security and correctness improvements: voting changes from fail-open anonymous fallback to fail-closed authenticated sessions, cookies gain conditional Secure handling, OAuth mock login is gated by an environment flag, open-redirect sanitization is strengthened, and these behaviors are covered by new tests. Side B is largely a URL/path refactor that centralizes room route encoding and adds URL normalization utilities, but most changes are mechanical rewrites of routing and link generation with comparatively less impact on core correctness and security.

Side B fixes a real security bug (votes silently falling back to an anonymous actor instead of failing closed), gates a test-only OAuth bypass behind an explicit env flag, adds Secure cookie support, and pins a git dependency to a rev instead of a mutable branch—all concrete, lasting correctness/security improvements with tests. Side A is a large mechanical rename/refactor (CanonicalItemUrl -> ItemId) that improves internal typing but changes no external behavior and even leaves a stray plan.md deletion with no functional payoff beyond restructuring existing logic.

A lands a core domain redesign: a real `ItemId` type (with wire split, parse/parent/display, serde) replaced `CanonicalItemUrl` through reducer maps, ranking, RPC, HTML routing, and tests—lasting structure rather than a string newtype. B adds important but narrower hardening (fail-closed `resolve_vote_actor`, mock-OAuth gate, Secure cookies, open-redirect checks, nav alias, durable rev pin); valuable security/UX, not the same system-wide foundation.

Side A replaces the project-wide `CanonicalItemUrl` string wrapper with a new `ItemId` type, introduces `item_id.rs`/`item_wire.rs`, updates reducer, ranking, routing, RPC, HTML, and tests to use structured identities, and adds `RouteContext`/`garden_item_href` integration. Side B meaningfully hardens authentication by making vote authorization fail closed, adding Secure cookie handling and redirect sanitization, but much of the patch is UI, configuration, and dependency pinning, whereas A establishes a broader, durable architectural foundation used throughout the codebase.

Side A fixes a real security bug (fail-open voting fallback to anon) with a fail-closed rewrite, adds Secure cookie support, gates mock OAuth behind an env flag, hardens open-redirect sanitization, and adds unit tests plus nav UI improvements—concrete, security-relevant lasting value. Side B is a larger refactor (new pair.rs module, vote.rs rewrite, ItemId::from_storage normalization) that is useful but is mostly internal restructuring/feature polish without addressing a correctness or security defect, and is labeled just 'refactor' with less durable architectural necessity than A's fixes.

B adds the core /vote compare surface, bridge-aware pair selection in pair.rs, ItemId::from_storage canonicalization, and in-place morph after votes—foundational product/ranking design with tests. A is real lasting security (fail-closed resolve_vote_actor, mock-OAuth gate, Secure cookies, open-redirect hardening) plus nav alias polish, but it hardens an existing path rather than delivering the main voting/ranking capability.

Side A introduces substantive security and correctness improvements: voting now fails closed instead of silently falling back to an anonymous actor, OAuth mocking is gated behind an explicit environment flag, Secure cookie handling is centralized, open-redirect sanitization is strengthened, and these behaviors are covered with new tests. Side B adds useful functionality around a pairwise voting UI, pair selection logic, and ID normalization, but much of the patch is feature work and refactoring rather than the broad, lasting hardening of core authentication and session handling delivered by Side A.

Side A fixes a genuine security bug (votes silently falling back to an anonymous actor instead of failing closed), gates the mock-OAuth test backdoor behind an explicit env flag, adds Secure-cookie support and stronger open-redirect sanitization, and backs these with new unit tests plus doc/Cargo.lock pinning improvements. Side B is a reasonable performance refactor (async settlement worker, cached ranking scores) and dead-code removal, but it adds no new tests for the concurrency/caching logic it introduces and its commit message ('nice') reflects low documentation effort, making its lasting correctness harder to verify compared to A's targeted, well-tested security hardening.

A hardens production auth (fail-closed vote actors instead of silent anon fallback, mock OAuth gated by env, Secure cookies, tighter return_to sanitization) and adds durable session UX/tests, which is lasting security and correctness. B’s settlement worker and ranking cache are solid core design and demo-counter removal is good cleanup, but they improve an earlier scaffold path rather than matching A’s multi-point security/ownership guarantees.

Side A makes several lasting security and correctness improvements: voting now fails closed by requiring a valid authenticated session instead of silently falling back to an anonymous actor, auth cookies gain the Secure flag when appropriate, OAuth mock login is gated behind an environment flag, and return URL sanitization is strengthened with tests to block additional open-redirect forms. Side B contains useful architectural cleanup (removing the demo counter, introducing cached rankings and a settlement worker), but much of it is refactoring/performance-oriented, whereas Side A directly fixes security and authorization behavior with concrete user-facing correctness benefits.

Side B fixes concrete security bugs (votes silently falling back to an anonymous actor instead of failing closed, missing Secure cookie flag, mock-OAuth escape hatch reachable in production, open-redirect edge case, and pinning the durable dependency by rev instead of a mutable branch) with focused tests for each fix. Side A is a large, mostly additive commit (Dockerfile, fly.toml, CI/deploy workflow, a new dashboard UI/CSS/JS) that does contain a couple of real fixes (per-repo object-hash dedup, fail-closed OPENROUTER_API_KEY check), but the bulk of the diff is spectacle-heavy UI/infra rather than correctness-critical logic.

A ships production authority (Docker/Fly/CI deploy), a real /watch audit surface with SSE progress state, and behavioral fixes (fail-closed ranking without OpenRouter, epoch retry, safer git auth/object checks) with matching tests—core lasting product capability. B’s fail-closed vote auth, mock-OAuth gate, Secure cookies, and open-redirect hardening are high-value security fixes, but narrower in scope than A’s end-to-end deploy-and-audit system.

Side A delivers substantial new operational capability: production deployment (Docker, Fly.io, CI/CD), a live audit dashboard with SSE-backed progress reporting, status APIs, authenticated GitHub access for repository discovery, improved startup/retry behavior, and tests covering the new functionality. Side B contains valuable security hardening—failing closed on unauthenticated voting, Secure cookies, tighter redirect validation, pinned git dependencies, and small UX improvements—but it is a narrower refinement of existing authentication rather than adding comparable long-term platform capability.

Side B fixes concrete security bugs: fail-closed vote resolution (previously any missing/expired session silently fell back to anonymous voting), gating mock OAuth behind an env flag, adding Secure cookie flags over HTTPS, closing an open-redirect vector in return_to sanitization, and pinning the `durable` git dependency to a rev instead of a floating branch. Side A is a large, mostly mechanical reorg (splitting canonical_path/identity modules, dropping `@` from wire form) that improves clarity but is lower-stakes churn compared to B's genuine auth-hardening fixes.

B’s fail-closed vote auth (no anon fallback), mock-OAuth env gate, Secure cookies, and tighter return_to sanitization are concrete security/correctness fixes with durable effect; A mostly relocates path/identity helpers and propagates a wire-format/@ convention change across many call sites. A’s module split and optional delegate are useful structure, but B delivers more necessary lasting value per change.

Side A introduces a lasting architectural separation by extracting `canonical_path.rs` and `identity.rs`, removing identity rewriting from the reducer, standardizing stored/wire identities without `@`, making delegates optional, and updating APIs and tests to enforce validated stored-form identities. Side B contains worthwhile security hardening—failing closed on unauthenticated voting, gating mock OAuth, adding Secure cookie handling, and tightening redirect validation—but its scope is narrower than A's broad cleanup of identity handling and normalization invariants across the project.

Side A delivers a focused, coherent security hardening pass: fail-closed vote authorization (no more silent anon fallback), gating mock OAuth behind an explicit env flag, Secure cookie support, stricter open-redirect sanitization, and nav UI updates, all backed by new unit tests. Side B, despite more lines, is a mixed grab-bag (dotenv loading, Reddit fetch refactor to explicit user action, raw payload persistence) with a vague commit message ('nice') and less clearly tied-together rationale, making Side A's security-focused, testable, necessary change more valuable for ownership purposes.

B redesigns core data flow: user-initiated fetch_entity, full EntityImported payloads in the event log, entity_raw on nodes with replay, and configurable API bases plus an end-to-end mock test—durable product architecture. A’s fail-closed votes, Secure cookies, mock-OAuth gate, and open-redirect tightening are real security fixes but narrower hardening of existing auth/UI rather than a foundational capability change.

Side A closes a significant security gap by changing vote identity resolution from anonymous fallback to fail-closed authenticated sessions, adds Secure cookie handling based on HTTPS, tightens return URL sanitization against open redirects, and gates mock OAuth behind an explicit test-only environment variable, with accompanying tests. Side B introduces a useful explicit Reddit import flow with event-sourced payload persistence and configurable API endpoints, but much of the patch is feature expansion rather than fixing correctness or security, making A's changes more durable to the project's integrity.

B fixes a genuine stored-XSS vulnerability by sanitizing untrusted Reddit HTML with ammonia before rendering via PreEscaped, a focused, correct, and testable security fix. A bundles several changes (fail-closed vote auth, mock OAuth gating, secure cookies, nav pseudonym display, dependency rev-pinning) that are useful but more diffuse and partly incidental (doc tweaks, CSS, pinning a git rev already used); both add real value but B's single well-scoped vulnerability fix with tests is a clearer, higher-confidence lasting improvement.

A changes core security semantics—votes fail closed without a live session/alias instead of falling back to anon, gates mock OAuth behind an env flag, sets Secure cookies from BASE_URL, and tightens return_to open-redirect checks—plus nav session UX and a durable rev pin. B is a sharp, lasting XSS fix (ammonia on Reddit body_html instead of raw PreEscaped) but is a single render-path hardening versus A’s broader auth/trust redesign.

Side A closes several authentication and security gaps by making vote actor resolution fail-closed instead of silently falling back to anonymous users, adding Secure cookie handling based on HTTPS, tightening open-redirect sanitization, gating mock OAuth behind an environment flag, and pinning the git dependency by revision for reproducible builds. Side B fixes an important XSS risk by sanitizing untrusted Reddit HTML with ammonia before rendering, but it is a more narrowly scoped security improvement compared with A's broader, durable authentication and deployment hardening.

A fixes a genuine auth bypass (mock_user OAuth was previously unguarded, letting anyone log in as any GitHub identity) and makes vote-actor resolution fail-closed instead of silently falling back to anonymous, plus pins the durable dependency by rev and adds Secure cookie flags and open-redirect hardening — all backed by new unit tests. B fixes a real but narrower bug (a shared browser delegate blocking concurrent human votes) with a good regression test, but its scope and security impact are smaller than the auth-bypass and fail-closed fixes in A.

B fixes a core multi-user breakage: a shared WEB_BROWSER_AGENT sentinel bound on the first browser vote and blocked later humans with AgentBound, by making PendingSession.agent optional and posting browser votes with no delegate, plus a two-user integration test. A’s fail-closed resolve_vote_actor, mock-OAuth gate, Secure cookies, and return_to hardening are real security wins, but they refine an existing auth path rather than removing a flawed design that stopped the product’s main multi-user flow.

Side A delivers several lasting security and correctness improvements: voting now fails closed instead of silently falling back to an anonymous actor, auth cookies gain conditional Secure handling, OAuth mock login is gated behind an environment flag, open-redirect sanitization is tightened, and the external `durable` dependency is pinned by immutable revision. Side B fixes an important multi-user bug by removing shared browser sentinel delegates and updating the session model/tests so browser users have no delegate, but its scope is narrower than A's combination of security hardening, authentication correctness, and reproducibility improvements.

A fixes a real security bug (votes silently falling back to anonymous instead of failing closed), adds tests for the sanitize/redirect logic, pins the durable dependency to an immutable rev instead of a mutable branch, and adds Secure-cookie support plus nav UX—concrete, verifiable hardening. B adds a substantial Reddit fetch worker with real logic (rate-limiting, OAuth, caching) which is useful, but is less critical to correctness/security and includes a stray 'todo' file and unrelated .gitignore tweak, making it slightly less polished/cohesive than A's tightly scoped security fix.

A delivers lasting security/correctness: fail-closed vote actors (no anon fallback), mock-OAuth gating, Secure cookies, tighter return-to sanitization with tests, plus dependency pinning—directly protecting vote integrity. B’s Reddit broker is a real feature with worker/rate-limit/OAuth design and tests, but it is product surface on top of stubs rather than core integrity fixes, and it also carries minor noise (.env gitignore, todo file).

Side A delivers durable security and correctness improvements: voting now fails closed instead of silently falling back to an anonymous actor, auth cookies gain conditional Secure handling, open-redirect sanitization is tightened and tested, mock OAuth is gated behind an explicit environment flag, and the durable dependency is pinned by immutable revision. Side B adds substantial Reddit import infrastructure with background fetching, OAuth support, and parsing, but it is largely new feature code with a TODO trail, whereas Side A fixes authentication and reproducibility issues that have broader long-term impact on project integrity.

Side B fixes a real correctness bug (timestamp-based feed cutoffs colliding/rolling back across users) with a principled ingest-index anchor, deduplicates duplicated logic into a shared rpc_feed helper, and adds substantial targeted integration tests proving multi-user permission and ordering correctness. Side A also delivers real security hardening (fail-closed votes, Secure cookies, open-redirect fixes) but is more incremental/config-oriented, whereas B's fix addresses a subtler and more consequential data-correctness/leakage bug with broader test coverage.

B fixes foundational feed correctness by anchoring catch-up to durable ingest index (not wall-clock ms), so same-millisecond and clock-rollback posts are not missed, and adds room-scoped permission filtering plus multi-user private-room/revoke integration tests and a room field on FeedPost. A’s auth fail-closed votes, mock-OAuth gate, Secure cookies, and open-redirect hardening are real security wins, but they are more localized hardening/UI (nav alias) and dep pinning than B’s ledger semantics change.

Side B refactors feed generation into a shared `rpc_feed` path and fixes a correctness bug by anchoring implicit catch-up to durable ingest order instead of timestamps, preventing missed posts during same-millisecond events or clock rollback while preserving permission checks. It also adds extensive multi-user integration tests covering private-room visibility and revoked access, whereas Side A primarily hardens authentication (fail-closed voting, Secure cookies, redirect sanitization, mock OAuth gating) and adds UI/account polish.

Side A fixes a real security fail-open bug (votes falling back to anon on missing/expired session) with fail-closed logic, adds Secure cookie support, mock-OAuth gating, open-redirect hardening with tests, and nav UX—each backed by concrete tests. Side B is a legitimate but narrower bugfix (unifying tilde-root storage key variants) with good test coverage, but it's a more localized correctness patch versus A's broader security-critical hardening across auth, cookies, and vote integrity.

A delivers product-critical integrity: fail-closed vote auth (no silent anon fallback), mock OAuth gated behind env, Secure cookies, and tighter return-to sanitization—plus durable pinned by rev. B is a real lasting path-identity fix (tilde root normalization so garden child/rank lookups hit storage keys) with strong tests, but it is narrower domain plumbing than A’s multi-bug security/auth hardening.

Side A makes substantive security and correctness improvements: voting now fails closed instead of silently falling back to an anonymous actor, auth cookies gain the Secure flag when appropriate, mock OAuth is gated behind an environment flag, open-redirect sanitization is strengthened, and these behaviors are covered by tests. Side B fixes canonical tilde-path handling and root normalization across routing, ranking, and rendering with good regression tests, but its impact is narrower than the authentication hardening and session correctness changes in Side A.

B fixes a real, concrete multi-user bug (a shared sentinel delegate causing 'AgentBound' collisions that blocked votes from a second human), verified with a targeted integration test proving two distinct users can now vote. A adds genuine security hardening (fail-closed auth, Secure cookies, open-redirect fixes) which is valuable, but it also mixes in unrelated cosmetic nav changes and a dependency pin tweak, diluting its focus; both are solid, but B's fix addresses a functional correctness bug with clear before/after proof.

B fixes a core correctness bug: a shared WEB_BROWSER_AGENT sentinel bound on the first browser vote and blocked every later human with AgentBound; making PendingSession.agent optional and posting votes with no delegate restores multi-user voting, with a direct two-user integration test. A’s fail-closed sessions, mock-OAuth gate, Secure cookies, and open-redirect hardening are real lasting security work, but they are layered controls and UX around auth rather than unblocking the product’s primary multi-user path.

Side A makes several durable security and correctness improvements: voting now fails closed instead of silently falling back to an anonymous actor, auth cookies gain the Secure flag when appropriate, OAuth mocking is gated behind an environment flag, open-redirect sanitization is strengthened with tests, and the durable dependency is pinned by revision for reproducible builds. Side B fixes a real multi-user bug by removing shared browser delegate sentinels and updating pending-session handling and tests, but its scope is narrower than the broader authentication hardening and security improvements in Side A.