c_c0df72aee6daf14ca6

Side B fixes a genuine XSS vulnerability (raw untrusted Reddit HTML rendered via PreEscaped) with a real, tested sanitization module applied at both render sites, which is a lasting security fix. Side A is a moderate refactor removing legacy projection code paths and simplifying evidence pages, which is useful cleanup but lower-impact than closing a script-injection hole, and much of B's diff (Cargo.lock) is generated noise rather than authored logic.

A removes dual-path legacy projection helpers (_legacy_commit_row, _legacy_observation) and all GitDiscovery/Emission fallbacks from epoch/commit pages and downloads, forcing Evidence envelopes only (with required Emission fields and updated tests), a lasting schema/design cleanup; B is a correct but narrower XSS fix that adds ammonia sanitization of body_html at two PreEscaped sites plus unit tests.

Side B fixes a concrete security issue by sanitizing untrusted Reddit `body_html` with the `ammonia` library before passing it to `maud::PreEscaped`, adds focused tests verifying scripts and event handlers are removed, and applies the protection consistently in both rendering paths. Side A primarily removes legacy GitDiscovery projection code and makes the application Evidence-only, simplifying behavior and updating tests/schema requirements, but it largely deletes compatibility logic rather than adding a broadly protective capability.

Side A fixes a real XSS vulnerability by sanitizing untrusted Reddit HTML before rendering, a small, precise, security-critical change with tests. Side B is a large refactor consolidating POST /post, /post/check, /post/redact into a single /ui RPC endpoint—useful cleanup but riskier, sprawling, and not addressing a correctness/security defect.

A adds a real, lasting XSS defense (ammonia whitelist + tests) for untrusted Reddit HTML embedded via PreEscaped, fixing a concrete security hole at the render sites. B is a worthwhile unification of /post* into the /ui RPC path and deletion of web_post.rs, but it is mostly moving and rewiring existing logic without new protective or functional substance.

Side A fixes a concrete security vulnerability by introducing Ammonia-based sanitization for untrusted Reddit `body_html` before `maud::PreEscaped` rendering, adds a reusable `entity_body_html` helper, and includes tests verifying scripts and event handlers are stripped while benign markup is preserved. Side B is primarily a large refactor that consolidates `/post*` flows into `/ui`, moves code, and changes routing and form submission patterns, but it mostly reorganizes existing behavior rather than adding comparable enduring functionality.

Side B fixes a real security vulnerability (XSS via unsanitized Reddit selftext_html) using ammonia, with tests verifying script/attribute stripping while preserving benign markup—a durable, necessary fix. Side A is a speculative refactor (selector-based morphing, reusing entity_section in vote compare) that removes working vote-compare-specific markup/CSS and introduces a stray malformed match-arm pipe, with unclear net benefit and no tests.

B fixes a real XSS hole by sanitizing untrusted Reddit body_html with ammonia before PreEscaped render, plus a small sanitize module and tests—lasting security value. A is useful UI design (data-entity-section selectors, vote cards reusing entity_section, CSS cleanup) but is mostly structural reuse, not a correctness fix of comparable weight.

Side B fixes a significant security issue by sanitizing untrusted Reddit `body_html` with the `ammonia` crate before passing it to `maud::PreEscaped`, preventing script and event-handler injection, and adds focused tests for the sanitizer. Side A mainly refactors entity rendering to use per-item `data-entity-section` selectors for SSE/Idiomorph updates and reuses the entity component in the vote UI, which improves structure but is less critical and lasting than closing an XSS risk.

Side B fixes a real XSS vulnerability by sanitizing untrusted Reddit HTML at render time with a well-scoped ammonia integration and includes targeted unit tests proving script/onerror stripping while preserving benign markup. Side A fixes a plausible bug in child-import path wiring and threads tree context for unranked labels, which is useful but more narrow and lower severity than closing a script-injection hole in rendered untrusted content.

B closes a lasting XSS hole by sanitizing untrusted Reddit body HTML with ammonia at render time (focused sanitize module + unit tests) instead of raw PreEscaped. A is a real functional fix (apply_entity_under_parent, title-based unranked labels, stronger import tests) but is feature/correctness work, not foundational safety like B.

Side B fixes a significant security issue by introducing HTML sanitization with the `ammonia` library and routing all Reddit `body_html` rendering through `entity_body_html`, preventing untrusted `selftext_html` from executing scripts while preserving benign markup with tests. Side A improves Reddit child import behavior by attaching imported posts directly under the subreddit and displaying child titles correctly, plus expands integration tests, but those are primarily functional correctness and UX improvements rather than a cross-cutting security hardening.

B fixes a genuine stored-XSS vulnerability by sanitizing untrusted Reddit HTML with ammonia before rendering via PreEscaped, a focused, correct, and testable security fix. A bundles several changes (fail-closed vote auth, mock OAuth gating, secure cookies, nav pseudonym display, dependency rev-pinning) that are useful but more diffuse and partly incidental (doc tweaks, CSS, pinning a git rev already used); both add real value but B's single well-scoped vulnerability fix with tests is a clearer, higher-confidence lasting improvement.

A changes core security semantics—votes fail closed without a live session/alias instead of falling back to anon, gates mock OAuth behind an env flag, sets Secure cookies from BASE_URL, and tightens return_to open-redirect checks—plus nav session UX and a durable rev pin. B is a sharp, lasting XSS fix (ammonia on Reddit body_html instead of raw PreEscaped) but is a single render-path hardening versus A’s broader auth/trust redesign.

Side A closes several authentication and security gaps by making vote actor resolution fail-closed instead of silently falling back to anonymous users, adding Secure cookie handling based on HTTPS, tightening open-redirect sanitization, gating mock OAuth behind an environment flag, and pinning the git dependency by revision for reproducible builds. Side B fixes an important XSS risk by sanitizing untrusted Reddit HTML with ammonia before rendering, but it is a more narrowly scoped security improvement compared with A's broader, durable authentication and deployment hardening.

Side A fixes a genuine XSS vulnerability by sanitizing untrusted Reddit HTML before rendering, adding a well-scoped module with tests and a clear security rationale. Side B fixes a real but narrower reducer bug (ghost items/pairs from zero-ratio votes) with a small, correct code move and updated test, which is valuable but lower-impact than closing an XSS hole.

A closes a real XSS hole by sanitizing untrusted Reddit HTML with ammonia at render time (shared helper, two call sites, unit tests), which is lasting security value. B is a precise, correct reducer bugfix (move zero-ratio return before ensure_item/voted_pairs) that prevents ghost state, but its scope and impact are narrower than preventing script execution in-origin.

Side A adds HTML sanitization with the `ammonia` library and routes all rendering of Reddit `body_html` through a shared `entity_body_html` function, preventing untrusted HTML (including scripts and event handlers) from executing while adding tests for benign and malicious input. Side B fixes an ordering bug by moving the zero-ratio early return before `ensure_item` and `voted_pairs.insert`, preventing ghost items and stale voted-pair state, but its impact is narrower than the cross-cutting XSS mitigation in Side A.

Side A delivers substantive architectural work: vendoring a durable RocksDB crate, moving entity payloads off the in-memory tree into disk storage, and refactoring event log replay to stream line-by-line, all with tests and real integration changes across reducer/state/reddit modules. Side B is a small, focused XSS fix (HTML sanitization via ammonia) that is valuable but narrow in scope compared to A's broader storage/performance redesign with new modules, tests, and cross-cutting changes.

Commit A delivers lasting architectural value by introducing a RocksDB-backed durable store for entity payloads (removing them from in-memory GlobalTree) plus streaming event-log replay, which directly cuts startup RAM and scales the core data path; the large patch is mostly the purpose-built durable crate plus focused server integration. Commit B is a correct, necessary XSS fix via ammonia sanitization at render time, but it is a narrow, localized hardening change compared with A’s systemic design improvement.

Side A makes a substantial architectural improvement by introducing a RocksDB-backed `durable` crate, moving raw Reddit entity payloads out of the in-memory tree into an `EntityStore`, and replacing event-log startup loading with streaming replay via `EventLog::replay`, reducing memory use and changing persistence design across the project. Side B is a valuable security fix—adding `ammonia` sanitization before rendering `selftext_html` and testing that scripts/event handlers are stripped—but it is a localized rendering hardening compared with A's broad, lasting infrastructure changes.

B fixes a genuine XSS vulnerability by sanitizing untrusted Reddit HTML before rendering with maud::PreEscaped, a real security bugfix with focused scope and tests. A is a larger feature/refactor (theme cookie persistence + private-room URL prefixing) that adds real value but is more sprawling churn across many files without addressing a security risk; both are legitimate, but B's correctness impact is more critical and self-contained.

A delivers lasting product infrastructure: server-side theme cookies with POST /theme, layout wiring, and especially room-aware wire URLs (item_path_for_api_in_room, forum_thread_web_url) threaded through RPC with tests. B is a precise, high-value XSS fix (ammonia on Reddit body_html) but narrower in scope than A’s combined theme + private-room API correctness work.

Side B closes a concrete security vulnerability by sanitizing untrusted Reddit HTML with `ammonia` before passing it to `maud::PreEscaped`, preventing script and event-handler execution while preserving safe markup, and adds focused tests for that behavior. Side A adds substantial functionality around theme persistence and room-aware URLs, but it is largely feature work spread across many handlers rather than a single correctness or security fix with comparable lasting risk reduction.

A fixes a real security vulnerability (unsanitized Reddit HTML enabling XSS) with a focused, well-tested sanitize module, which is high-value and low-risk. B is a larger architectural refactor (async settlement worker, cached ranking, dead demo-counter removal) that's plausible but riskier, untested for the new worker's concurrency correctness, and its commit message ('nice') signals less deliberate documentation of intent despite the code volume.

B removes demo-counter scaffolding and introduces a lasting settlement worker that batches votes, persists events, and warms/serves cached ranking scores under read locks—core product architecture. A is a correct, necessary XSS fix (ammonia at render + tests) but a localized hardening of existing PreEscaped paths, not a comparable structural contribution.

Side A fixes a concrete security vulnerability by introducing HTML sanitization with the `ammonia` library, routing all `body_html` rendering through `entity_body_html`, and adding tests that verify scripts and event handlers are stripped while preserving safe markup. Side B mostly removes the demo counter and refactors ranking updates into a settlement worker with cached reads, which is a useful architectural change but does not address as fundamental or broadly lasting a correctness issue as preventing XSS from untrusted Reddit HTML.

Side A fixes a real, scoped security bug (XSS via unsanitized Reddit HTML) with a small, well-tested, focused change (sanitize.rs + two call sites + unit tests). Side B is a large, unfocused grab-bag (dotenv loading, explicit fetch UI, event-log payload storage/replay, reddit config refactor, integration test harness) that adds significant surface area and complexity without a single clear, well-isolated purpose, making it harder to review and more risky despite adding some legitimate architecture (raw payload persistence, explicit fetch).

B lands lasting architecture: explicit user-initiated fetch, full API payloads in EntityImported/event-log replay, entity_raw + derived views, configurable Reddit bases, and a mock-backed integration test. A is a correct, focused XSS fix (ammonia at PreEscaped render sites with unit tests) but is shorter-scope hardening on top of entity HTML, not a comparable product/design step.

Side A fixes a concrete security issue by sanitizing untrusted Reddit `body_html` with the `ammonia` library before every `maud::PreEscaped` render, adds a dedicated sanitization module, and includes tests verifying scripts and event handlers are stripped while benign markup is preserved. Side B introduces a broad Reddit import/event-log refactor, explicit fetch UI, dotenv support, and related plumbing, but it is a much larger architectural change whose core value is feature expansion rather than addressing an immediate correctness or security problem.

Side A fixes a real XSS vulnerability by sanitizing untrusted Reddit HTML before rendering, with a clear, minimal, well-tested implementation (dedicated sanitize module with unit tests). Side B improves reliability of Reddit fetching (forcing OAuth, retry-on-401/403) which is valuable but more narrowly operational/infra-focused and adds significant complexity/duplication in error handling; both are legitimate, but A addresses a security-critical defect with lasting design value.

B fixes production-critical Reddit fetching by requiring OAuth when credentials exist (no public www fallback that cloud IPs block), with token refresh on 401/403 and clearer auth error handling—core durability for the app’s data path. A is a real, lasting XSS hardening via ammonia at render time with tests, but it is a narrower defense on already-fetched HTML versus B’s broader reliability/design change to the fetch/auth pipeline.

Side A fixes a significant cross-site scripting risk by introducing centralized HTML sanitization with `ammonia` before rendering Reddit `body_html`, updating both rendering paths to use `entity_body_html`, and adding tests to verify benign markup is preserved while scripts and event handlers are removed. Side B improves Reddit API reliability by requiring OAuth when configured, retrying after 401/403 with token refresh, and improving error handling, but its impact is narrower to deployment and API interactions, whereas the security hardening in Side A provides broader, lasting protection for all rendered untrusted content.

Side B fixes a real concurrency/correctness bug (a shared sentinel delegate blocking multi-user votes) with a coherent refactor (Option<String> agent), updated tests including a new integration test proving the fix, and cleanup of now-dead sentinel logic across CLI/server/types. Side A also adds real value (HTML sanitization to prevent XSS) but its diff is dominated by a large generated Cargo.lock dependency tree, and the actual logic change is a small, straightforward wrapper function with modest test coverage.

B fixes a core multi-user breakage by removing shared browser sentinel delegates (WEB_BROWSER_AGENT/INVITE_BROWSER_AGENT) and modeling PendingSession.agent as Option so human votes no longer AgentBind a single fake delegate; it updates auth, UI posts, authorship, types/CLI poll handling, and adds a two-user integration test. A is a real, lasting XSS harden (ammonia at render for body_html with unit tests) but is a narrower sanitize-at-boundary change versus B’s correct data-model and product-path fix.

Side A closes a significant security gap by sanitizing untrusted Reddit `body_html` with `ammonia` before passing it to `maud::PreEscaped`, adds a dedicated sanitizer module, and includes tests verifying scripts and event handlers are stripped while benign markup is preserved. Side B fixes an important browser-auth design bug by removing shared sentinel delegates, switching browser sessions to `None` delegates, and adding strong integration tests for multi-user voting, but its impact is narrower than preventing XSS in rendered content.

Side A fixes a real, security-relevant bug (XSS via untrusted Reddit HTML) with a small, focused, well-tested change (new sanitize module + call sites + tests), delivering clear lasting value. Side B is a large, diffuse refactor touching voting UI, pair selection, ID normalization, and test infra with mixed concerns and no security or correctness fix of comparable importance, making its net contribution harder to justify as cleanly as A's targeted fix; notably it also reintroduces the unsanitized `PreEscaped(body)` pattern for entity bodies in vote_compare_item_card, potentially regressing the exact issue A addresses.

B lands lasting product design: bridge-aware pair selection in pair.rs, the /vote compare page with in-place morph after record_vote, ItemId::from_storage slug normalization (used in reddit/reducer/parse paths), plus integration coverage—far more than module reshuffling. A is a correct, necessary XSS fix (ammonia at PreEscaped render sites with tests) but a narrow hardening change versus B’s core ranking/vote behavior.

Side A fixes a concrete security issue by introducing HTML sanitization with the `ammonia` library before rendering untrusted Reddit `body_html`, replacing direct `PreEscaped(body)` output with `entity_body_html(body)` and adding tests that verify scripts and event handlers are stripped while benign markup is preserved. Side B adds a substantial new voting UI, pair-selection logic, and refactoring, but it is largely feature work and even continues rendering `body_html` with `PreEscaped` in the new vote comparison page, whereas Side A provides a focused, lasting security improvement that protects all affected rendering paths.

B is a small, focused security fix that closes an actual XSS hole (untrusted Reddit selftext_html rendered raw via PreEscaped) with a tested sanitizer applied at both render sites. A is a large ItemId refactor that improves internal typing but introduces lossy fallbacks (ItemId::opaque on parse failure) and a deleted plan.md, providing real but riskier and less immediately critical value than fixing a live script-injection vulnerability.

Side A delivers a structural ItemId type and migrates the reducer, ranking, RPC, and HTML paths off stringly CanonicalItemUrl keys—lasting core design that the deleted plan.md targeted end-to-end. Side B is a real, precise XSS fix (ammonia on Reddit body_html at two render sites plus tests), but it is narrow compared with the architecture-wide identity change.

Side A performs a broad architectural migration from `CanonicalItemUrl` strings to a first-class `ItemId` type, adds the new `types/src/item_id.rs` and `item_wire.rs` modules, and propagates the stronger identity model through reducers, ranking, routing, APIs, and tests. Side B is an important targeted security fix—introducing `ammonia` to sanitize untrusted Reddit HTML before `PreEscaped` rendering with tests—but its scope is limited to one rendering path, while Side A changes a core project abstraction with lasting impact across the codebase.

Side B is a real security/design fix: an XSS-critical bug where the reducer was silently mangling stored identity strings (double-canonicalizing usernames/agents), replaced with strict parse-at-the-boundary validation, consistent wire format, optional delegates, and updated tests across CLI/server/integration suites. Side A adds a genuinely useful sanitize-on-render fix for untrusted HTML but is a much smaller, single-purpose patch mostly composed of a large auto-generated Cargo.lock diff for a new dependency, with limited actual logic (one small module plus two call-site edits).

B delivers a lasting architectural cleanup: split identity/canonical_path modules, make wire/storage form strict (no @ rewriting in the reducer), optional delegates, and consistent API/HTML separation across many call sites. A is a correct, necessary XSS harden (ammonia + small sanitize helper + tests) but narrower in scope than B’s model and boundary changes.

Side A fixes a concrete security vulnerability by introducing Ammonia-based sanitization for untrusted Reddit `body_html` before `maud::PreEscaped` rendering, wiring it into both render paths and adding tests that verify scripts and event handlers are stripped while benign markup is preserved. Side B is a broad refactor that separates identity and path canonicalization and changes API conventions (stored-form usernames, optional delegates), but it is largely structural and behavioral cleanup rather than delivering a comparably critical, lasting user-facing improvement.

Commit B implements a substantial, working feature: a background Reddit fetch worker with OAuth token handling, rate-limit/backoff logic, URL mapping, JSON parsing, and integration into app state/routing, backed by unit tests. Commit A is a small, valuable but narrow security fix (HTML sanitization via ammonia) plus a large generated Cargo.lock diff, which is useful but much smaller in scope and lasting design impact than B's core feature implementation.

B replaces a stub Reddit fetch with a full broker/worker (OAuth, rate limits, URL mapping, JSON parsing, tree updates, and tests), which is core product capability. A is a necessary XSS harden (ammonia + render call sites) but is a small follow-on safety layer on body_html, not comparable in lasting scope to the integration itself.

Side B implements a substantial Reddit integration: it adds a background fetch broker with deduplication, rate limiting, OAuth support, JSON parsing into EntityData, automatic fetch triggering from application state and browse requests, and accompanying tests. Side A fixes an important XSS risk by introducing Ammonia-based sanitization before rendering Reddit HTML with tests, but it is a focused security hardening change affecting only rendering, whereas Side B establishes a major lasting subsystem for Reddit data ingestion.

Side B fixes a real concurrency bug (shared sentinel delegate blocking multi-user votes) with a proper type-level fix (Option<String>), adds a targeted regression test proving two distinct users can vote without collision, and updates related call sites/tests coherently. Side A adds a genuine security improvement (HTML sanitization) but the diff is dominated by a huge, uninteresting Cargo.lock dependency tree; the actual code change is small but valuable, while Side B's fix addresses a more fundamental correctness bug affecting core multi-user functionality with better test coverage.

B fixes a core multi-user blocker by making PendingSession.agent Option<String>, dropping shared WEB_BROWSER_AGENT/INVITE_BROWSER_AGENT sentinels that caused AgentBound collisions on later human votes, and adding an integration test proving two users can both vote with no delegate. A is a solid, localized XSS hardening (ammonia + entity_body_html at two PreEscaped sites with unit tests) but does not alter foundational auth or collaboration behavior.

Side A introduces a targeted security improvement by sanitizing untrusted Reddit `body_html` with `ammonia` before every `PreEscaped` render, adds a dedicated sanitization module, and includes tests that verify scripts and event handlers are stripped while benign markup is preserved. Side B fixes an important correctness issue by removing the shared browser delegate sentinel and updating session types and tests so multiple browser users can vote independently, but the XSS mitigation in A provides broader, long-term protection across all rendered Reddit content.

B fixes a real, subtle correctness bug (inconsistent canonical root URL representations causing sibling/child lookups to silently fail) with a well-reasoned normalization scheme, new unit/integration/browser tests, and clear documentation of the string-kind invariants. A is a legitimate security fix (HTML sanitization) with good targeted tests, but most of its diff is generated Cargo.lock noise from adding a heavyweight dependency (ammonia + ~40 transitive crates), making its actual code contribution much smaller than B's substantive path-handling fix.

B fixes foundational CanonicalItemUrl identity (legacy `…/~/` vs `…/~` root keys, normalized_storage, tilde_http_path_to_canonical) so garden child rankings and room/public root pages resolve correctly, backed by unit, integration, and browser tests. A is a real, precise XSS harden (ammonia at PreEscaped render sites plus targeted sanitize tests) but is localized to Reddit HTML embedding, whereas B corrects core path/storage design the app relies on everywhere.

Side A closes a concrete security vulnerability by sanitizing untrusted Reddit `body_html` with `ammonia` before every `PreEscaped` render, centralizing the logic in a new `html::sanitize` module and adding tests that verify scripts and event handlers are stripped while benign markup is preserved. Side B is a valuable correctness refactor that normalizes canonical ontology root paths, fixes routing/storage edge cases, and adds extensive regression tests, but its impact is narrower than preventing cross-site scripting in rendered user content.