c_ca9169f732b82c47af

B fixes a real production bug: forcing OAuth when configured, retrying on 401/403 with token refresh, and improving error diagnostics, all backed by a test—concrete lasting logic improvements. A merely adds deployment documentation and config for an unrelated tool (Open WebUI) with no code or bugfix content.

B fixes a real production failure path in reddit.rs: it stops falling back to the public www.reddit.com API when OAuth creds exist, retries on 401/403 with forced token refresh, and surfaces AuthRejected cleanly—plus a small fly.toml pin. A only adds peripheral Open WebUI deploy scaffolding (README + fly.toml), which is useful docs/config but not core correctness.

Side B implements a substantive reliability fix in the Reddit client: when OAuth credentials are configured it no longer falls back to blocked public endpoints, retries once after refreshing tokens on 401/403, improves error propagation, and adds a test for error-message truncation. Side A mainly adds deployment documentation and a Fly.io configuration for Open WebUI, which is useful but does not change the project's core runtime behavior in the same lasting way.

Commit A fixes a real production-breaking bug (public Reddit API blocking cloud IPs) with a correct, well-tested retry/refresh design for OAuth tokens, adding lasting robustness to a critical integration. Commit B adds a nice-to-have UI feature (copy-to-clipboard for garden rankings) which is useful but purely additive and non-critical, with more surface area but less foundational impact than fixing a broken core fetch path.

A fixes a production-breaking Reddit fetch path (no public www fallback from cloud IPs, OAuth required when creds exist, 401/403 refresh/retry, clearer AuthRejected handling) plus a deploy pin for SORTER2_BASE_URL—core reliability. B is a polished UX add-on (CopyGardenRank markdown clipboard, wire-up, tests) that reuses existing patterns but does not fix foundational breakage.

Side A fixes a production reliability issue by requiring OAuth when credentials exist, preventing fallback to blocked public Reddit endpoints, adding token refresh/retry on 401/403, improving error propagation, and covering the behavior with a test. Side B adds a useful UI feature for copying garden rankings as markdown with routing, rendering, and tests, but it is an incremental convenience feature rather than a foundational correctness and availability improvement.

Side B is a targeted, real bugfix: it correctly forces OAuth when credentials exist, adds retry-on-401/403 logic with token refresh, improves error reporting, pins the base URL in fly.toml, and includes a new test validating the error-truncation logic. Side A merely adds unintegrated scaffold files (Dockerfile, deps.edn, event_log.rs, views.rs) that aren't wired into the build and provide no demonstrated behavior or fix, offering speculative seed code rather than lasting, verified value.

B is a targeted production fix: force OAuth when credentials exist (no public www.reddit.com fallback that cloud IPs hit as 403 HTML), add AuthRejected + one-shot token refresh, tighten ensure_oauth_token errors, and pin SORTER2_BASE_URL, with a unit test for truncate_for_error. A mainly seeds Dockerfile/fly.toml plus new event_log/views modules and an unrelated Clojure deps.edn—useful scaffolding, but more breadth than a lasting correctness fix on the live Reddit path.

Side B fixes a concrete production behavior by requiring OAuth when credentials are configured, adding token refresh and retry on 401/403 responses, improving error propagation, and introducing a targeted test for error truncation. Side A mostly adds infrastructure and new utility files (Dockerfile, deployment config, event log, view persistence, Clojure deps), but without showing their integration into the application, making their lasting project impact less certain than B's focused reliability fix.

A adds a substantial, tested infrastructure change (RocksDB-backed entity storage, streaming event replay) that reduces startup RAM and cleanly separates raw payloads from in-memory tree state, verified by new unit/integration tests. B is a smaller but real bugfix (mandatory OAuth with retry-on-401/403 and better error truncation) that fixes a genuine production reliability issue, but its scope and lasting architectural impact are narrower than A's.

A introduces lasting architectural value by offloading bulky Reddit entity JSON from the in-memory GlobalTree into a RocksDB-backed EntityStore (via the vendored durable crate) and by replacing full event-log materialization with true streaming replay, which directly cuts startup RAM; the integration touches entity_store, event_log, reducer, state and reddit paths with accompanying tests. B is a correct, necessary production bugfix (force OAuth when credentials exist, refresh on 401/403, avoid the public www.reddit.com block page, plus a fly.toml pin) but is narrower in scope and impact.

Side A makes a substantial architectural change: it introduces a RocksDB-backed `durable` workspace crate, moves raw Reddit entity JSON out of the in-memory tree into a persistent `EntityStore`, and replaces startup's `load_all()` with streamed event-log replay via `EventLog::replay`, reducing memory usage while preserving functionality. Side B is a valuable operational bugfix that requires OAuth when configured, refreshes tokens after 401/403, and avoids fallback to blocked public endpoints, but its scope is limited compared with Side A's long-term persistence and scalability improvements.

Side B fixes a real production bug (cloud IPs getting blocked by Reddit's public API, requiring OAuth with proper 401/403 retry-and-refresh logic) plus adds a unit test and config fix, directly improving reliability. Side A adds a new feature (RoomList) with solid test coverage, but it's incremental scope addition rather than fixing an existing correctness/reliability issue, making B's fix marginally more consequential to production stability.

B fixes a load-bearing production failure: when Reddit credentials exist it never falls back to www.reddit.com (blocked from cloud IPs), adds AuthRejected handling with forced token refresh/retry, and hardens OAuth error paths—directly keeping core fetch working. A adds a useful but thin RoomList vertical slice (grant filter + CLI + isolation tests) that expands the API without the same operational necessity.

Side B fixes a production reliability issue by requiring OAuth when credentials exist, retrying once after 401/403 with a forced token refresh, improving error propagation, and avoiding fallback to blocked public Reddit endpoints; it also adds a focused test for error truncation. Side A adds a useful RoomList RPC, CLI subcommand, response type, and comprehensive integration tests, but it is primarily a new feature, whereas Side B addresses a deeper operational correctness problem that prevents fetch failures in deployed environments.

B fixes a real production bug (Reddit OAuth fallback causing hard 403 blocks from cloud IPs), adding proper retry-on-401/403 logic, better error truncation, and a config fix (SORTER2_BASE_URL), with a targeted test. A is a substantial but purely cosmetic/UX feature (theme switcher moved to a form-based cookie approach plus room-scoped URL prefixing) that adds real value but is less critical than fixing broken external API integration.

A delivers lasting product infrastructure: cookie-backed server-rendered themes (POST /theme, layout/auth propagation so login does not drop theme) plus private-room wire URL helpers (`item_path_for_api_in_room`, `forum_thread_web_url`) wired through RPC with tests. B is a critical but narrower production fix—force OAuth when credentials exist, AuthRejected + one refresh on 401/403, and pin SORTER2_BASE_URL—so Reddit cloud fetches stop falling back to blocked www endpoints.

Side A adds a durable cross-cutting feature by introducing server-backed theme persistence (cookie handling, POST /theme, layout integration, preserving the theme across authentication) and systematically propagating room-aware URLs through RPC responses with helper functions and tests. Side B fixes an important Reddit integration issue by requiring OAuth when configured, retrying after 401/403 with token refresh, and improving error handling, but it is a narrower subsystem-specific reliability improvement compared with A's broader architectural enhancements.

Side A fixes a concrete production bug (silent fallback to a blocked public Reddit endpoint), adds real retry-on-401/403 logic with tests, and improves error diagnostics — a focused, verifiable improvement. Side B is a large DSL syntax reshuffle (moving explanations before votes) whose diff is dominated by mechanical test/fixture rewrites across many files, which is churn-heavy relative to the core logic change in dsl.rs and lacks the same clear bugfix payoff for users in production today.

B redesigns the project’s core user-facing DSL (explanation-first votes, stricter block placement) with real parser/API/UI changes and coordinated fixture updates, so it shapes how content is authored going forward. A is a solid, necessary Reddit OAuth reliability fix (no public API fallback when creds exist, 401/403 refresh, error truncation) plus a fly.toml pin, but it is narrower infrastructure glue rather than lasting product surface.

Side A fixes a production reliability issue by requiring OAuth when credentials are configured, preventing fallback to blocked public Reddit endpoints, adding automatic token refresh/retry on 401/403, improving error propagation, and testing truncated error handling. Side B primarily changes the DSL syntax from trailing to leading explanation blocks and updates the parser, documentation, UI, and a large number of fixtures/tests to match; while substantial, much of the patch is migration and syntax churn rather than a clear functional improvement.

Side B fixes a real production bug (public Reddit API blocking cloud IPs) with a robust retry-on-401/403 mechanism, error surfacing via truncated messages, and a deployment config fix, all backed by a targeted unit test. Side A is a large refactor adding a new vote-compare feature and pair-selection logic, which is substantial but more speculative UI/UX work with less proven necessity and higher risk of churn compared to B's focused, correctness-driven fix.

A lands core product machinery: bridge-aware pair selection in pair.rs, the full /vote compare UI and in-place morph path (vote_recorded_morph, vote_compare flag), plus ItemId::from_storage normalization with tests—lasting design for ranking. B is a precise, necessary production fix (force OAuth when creds exist, AuthRejected + refresh on 401/403, fly.toml base URL) but narrower in scope than the vote/pair subsystem.

Side A delivers substantial new functionality and infrastructure: it adds a dedicated pairwise voting page, pair-selection logic that prioritizes bridging disconnected ranking components, in-place UI morphing after votes, ID normalization via `ItemId::from_storage`, and accompanying integration/tests. Side B fixes an important operational issue by requiring OAuth when configured, refreshing tokens after 401/403 responses, and improving error handling, but it is a narrower reliability improvement compared with the broader, lasting feature and architectural additions in Side A.

B fixes a real security bug (voting silently fell back to an anonymous shared actor on session failure, letting unauthenticated or expired-session requests record votes as a default identity) with fail-closed error handling, adds Secure-cookie support, gates a test-only mock OAuth path behind an env flag, and hardens open-redirect sanitization with tests. A is a solid, well-scoped reliability fix for Reddit OAuth fallback/retry with good error truncation and tests, but its scope is narrower and addresses an operational/API-blocking issue rather than a security-integrity flaw.

B hardens core product invariants: fail-closed vote auth (no anon fallback), Secure cookies driven by BASE_URL, mock-OAuth gated behind an env flag, and tighter return_to open-redirect checks, plus durable pinned by rev. A is a strong, focused production fix (require OAuth when creds exist, refresh on 401/403, clearer block-page errors) but is localized to the Reddit fetch path and a fly.toml env pin, so it carries less lasting cross-app weight than B’s auth/security design.

Side B hardens core authentication behavior by making vote attribution fail closed instead of silently falling back to an anonymous actor, adding Secure cookie handling based on HTTPS, tightening return URL validation against open redirects, and gating mock OAuth behind an explicit environment flag, with accompanying tests. Side A provides a valuable Reddit integration fix by requiring OAuth when configured, retrying after 401/403 with token refresh, and improving error handling, but its impact is narrower than the broader security and authentication improvements in Side B.

Side A fixes a real production bug (Reddit's block page silently poisoning fetches) with a robust retry/refresh mechanism, better error surfacing (truncate_for_error), and includes a unit test validating the fix — this is a correctness/reliability fix with lasting operational value. Side B adds a reasonable feature (pool-scoped voting) that is useful but more speculative UI/UX plumbing without tests, and is lower-stakes than fixing a hard failure mode in production data fetching.

A fixes a production-breaking Reddit path by requiring OAuth when credentials exist, refreshing on 401/403, and never falling back to the blocked www.reddit.com API, plus clearer AuthRejected handling—lasting correctness for cloud deploys. B is a solid product feature (pool-scoped /vote and UI wiring) but additive UX rather than fixing broken core data access.

Side A makes the Reddit integration substantially more robust by requiring OAuth when configured, adding a retry with forced token refresh on 401/403, propagating token acquisition errors instead of silently falling back, and improving error handling with targeted truncation and a regression test. Side B adds a useful pool-scoped voting feature and threads the new `pool` parameter through the UI and routing, but it is primarily new application functionality, whereas Side A addresses a production reliability issue that prevents blocked cloud deployments from functioning correctly.

Side B is a focused, real bugfix: it fixes production 403 blocks by making OAuth mandatory when creds exist, adds a token-refresh-and-retry path on 401/403, improves error messages, and pins a config value in fly.toml—directly addressing a deployment-breaking issue. Side A is a larger feature/refactor (raw entity import, explicit fetch UI, dotenv) that is useful but more diffuse, mixes unrelated concerns (UI, config loading, event schema), and includes a bespoke Clojure integration test that adds maintenance surface without clear necessity.

A adds lasting architecture: event-sourced EntityImported with full payload storage, explicit user-driven fetch UX (replacing auto-fetch on browse), configurable API bases, and a real mock-backed integration test. B is a focused, correct production fix (mandatory OAuth when creds exist, 401/403 refresh, fly.toml base URL) but much narrower in scope and impact on the codebase.

Side A introduces substantial new functionality and architecture: explicit user-triggered Reddit fetching, persistent `EntityImported` events with raw payload storage and replay, derived entity views, configurable API bases, UI controls, dotenv loading, and tests covering replay and end-to-end import. Side B is a valuable reliability fix that requires OAuth when credentials exist, retries after 401/403 with token refresh, and improves error handling for blocked responses, but it is a focused robustness improvement built on top of existing behavior rather than a broader lasting capability.

Side B fixes a real production bug (cloud IPs falling back to public Reddit API and getting blocked) with proper OAuth retry-on-401/403 logic, better error surfacing, and a config fix in fly.toml — a concrete operational reliability improvement. Side A is a thoughtful refinement of pair-selection heuristics with good test coverage, but it's an internal algorithm tweak with more speculative long-term value compared to B's fix for an actively broken production path.

A upgrades core ranking behavior with a real design change: established-first bridge merges, then isolate attach, then zip-adjacent rank refinement once the pool is one component, backed by targeted tests. B is a valuable production fix (force OAuth when creds exist, refresh on 401/403, pin base URL) but is integration/ops hardening rather than lasting product algorithm value.

Side B fixes a concrete production reliability issue by requiring OAuth when credentials are configured, adding automatic token refresh/retry on 401/403, returning structured auth-rejection outcomes instead of failing generically, and improving error handling with focused diagnostics. Side A meaningfully refines the pair-selection heuristic (component attachment priorities and rank-adjacent refinement with tests), but it is primarily an algorithmic preference change, whereas Side B prevents fetch failures caused by Reddit's API behavior and hardens a critical integration.

Side B fixes a real production bug (Reddit blocking cloud IPs via public API fallback) with a robust auth-rejection/retry mechanism, better error messages, and a config pin, backed by a new test. Side A is mostly a refactor/removal of demo scaffolding plus a settlement-worker rewrite for ranking caching, which is reasonable engineering but less impactful and riskier (async batching complexity) without clear bug motivation.

A introduces a real settlement worker (batched votes, disk append, off-request ranking recompute), a cached ranked_items fast path with read locks, and deletes the demo-counter scaffold end-to-end—core architecture for the ranking product. B is a solid, narrower production fix (force OAuth when creds exist, refresh on 401/403, error truncation, fly base URL) but does not reshape the system the way A does.

Side A introduces a substantial architectural improvement by separating ranking recomputation from read paths via cached rankings, adding a settlement worker that batches vote persistence and score recomputation, warming the cache at startup, and converting ranking reads to shared locks. It also removes the temporary demo counter feature and associated UI/tests, reducing dead functionality. Side B fixes an important Reddit OAuth reliability issue by requiring OAuth when configured, refreshing tokens on 401/403, and improving error handling, but its impact is confined to one subsystem and is less broadly foundational than the state-management and performance changes in Side A.

Side A fixes a real production bug (cloud IPs hitting Reddit's block page), adds a proper OAuth-required retry/refresh path, error truncation, and a test, providing substantial lasting infrastructure value. Side B is a small, correct bugfix moving a guard before side effects, valuable but much narrower in scope and impact than A's change.

Commit A fixes a production-blocking path: when OAuth creds exist it never falls back to www.reddit.com (which returns network-security 403 HTML from cloud IPs), adds AuthRejected + forced token refresh/retry, and tightens error reporting—real lasting API reliability. Commit B is a correct but tiny guard reordering so zero-ratio votes skip ensure_item/voted_pairs; valuable data-integrity hygiene, yet far narrower in scope than A’s OAuth redesign.

Side A fixes a production-facing reliability issue by requiring OAuth when credentials exist, retrying once with a refreshed token on 401/403, propagating token acquisition errors instead of silently falling back, and improving error handling with truncated diagnostics and a regression test. Side B corrects an ordering bug by moving the zero-ratio early return before `ensure_item` and `voted_pairs.insert`, preventing ghost state, but it is a smaller, localized fix with narrower impact.

Side A fixes a real XSS vulnerability by sanitizing untrusted Reddit HTML before rendering, with a clear, minimal, well-tested implementation (dedicated sanitize module with unit tests). Side B improves reliability of Reddit fetching (forcing OAuth, retry-on-401/403) which is valuable but more narrowly operational/infra-focused and adds significant complexity/duplication in error handling; both are legitimate, but A addresses a security-critical defect with lasting design value.

B fixes production-critical Reddit fetching by requiring OAuth when credentials exist (no public www fallback that cloud IPs block), with token refresh on 401/403 and clearer auth error handling—core durability for the app’s data path. A is a real, lasting XSS hardening via ammonia at render time with tests, but it is a narrower defense on already-fetched HTML versus B’s broader reliability/design change to the fetch/auth pipeline.

Side A fixes a significant cross-site scripting risk by introducing centralized HTML sanitization with `ammonia` before rendering Reddit `body_html`, updating both rendering paths to use `entity_body_html`, and adding tests to verify benign markup is preserved while scripts and event handlers are removed. Side B improves Reddit API reliability by requiring OAuth when configured, retrying after 401/403 with token refresh, and improving error handling, but its impact is narrower to deployment and API interactions, whereas the security hardening in Side A provides broader, lasting protection for all rendered untrusted content.

Commit A fixes a real correctness bug (shared sentinel delegate blocking multi-user voting), removes dead/misleading abstractions cleanly, and adds a solid integration test proving two distinct users can vote without collision. Commit B is also a legitimate bugfix (avoiding blocked public Reddit API, forcing OAuth refresh) with good error-detail handling and a unit test, but it's a narrower operational fix versus A's core multi-user correctness fix affecting fundamental voting functionality.

Commit A removes the shared WEB_BROWSER_AGENT/invite sentinel design that bound AgentBound on the first browser vote and blocked later humans, making delegate Optional end-to-end (auth, PendingSession, UI posts, authorship, poll types) with a multi-user vote integration test—lasting core product correctness. Commit B is a solid production fix (mandatory OAuth when creds exist, 401/403 refresh, no public www fallback, fly.toml base URL) but is narrower operational resilience for the Reddit worker rather than a foundational multi-user model fix.

Side A removes the shared browser sentinel delegate by changing pending sessions and browser posts to use `Option<String>` delegates, eliminating a design flaw where one shared delegate caused later human votes to fail (`delegate already bound`). It also updates attribution logic and adds a comprehensive integration test verifying multiple browser users can vote independently, whereas Side B improves Reddit OAuth robustness with required OAuth, token refresh on 401/403, and clearer error handling but is confined to a specific integration path.

Side B fixes a genuine multi-user correctness bug (a shared sentinel delegate wrongly binding and blocking subsequent human voters) with a clean type-level fix (agent: Option<String>) plus a targeted regression test proving two distinct users can vote without collision. Side A also fixes a real reliability issue (OAuth fallback hitting Reddit's block page) with reasonable retry/error-detail handling, but it's a narrower infra fix with less systemic impact than B's multi-tenant correctness fix, and B's change is verified end-to-end across CLI, server, and types.

B fixes a core multi-user correctness bug: a shared WEB_BROWSER_AGENT sentinel bound on first vote and blocked later humans with AgentBound; making PendingSession.agent Option and posting with no delegate restores proper human votes, with a solid two-user integration test. A is a strong production fix (require OAuth when creds exist, refresh on 401/403, stop falling back to the blocked www.reddit.com path), but it is scoped to one external integration plus a fly.toml pin, whereas B corrects the app’s auth/delegate model end-to-end.

Side A strengthens Reddit integration by making OAuth mandatory when credentials exist, adding automatic token refresh and retry on 401/403 responses, propagating token acquisition errors instead of silently falling back, and improving diagnostics with truncated error messages plus a regression test. Side B fixes an important multi-user browser voting bug by removing shared sentinel delegates and updating session types and tests, but its scope is more localized compared with A's broader resilience and correctness improvements to external API handling.

Side A performs a genuine architectural cleanup: separating identity parsing/validation into a dedicated module, removing ad-hoc identity rewriting from the reducer, making delegate optional, and consistently updating wire/HTML boundaries with matching test and CLI updates across the whole codebase. Side B is a solid, scoped bugfix (forcing OAuth and retry-on-401/403 for Reddit fetches) with good error truncation and a test, but it's narrower in scope and impact compared to A's broader identity-model correctness fix that touches API contracts, storage, and display logic throughout the system.

A permanently separates path vs identity concerns, makes wire/storage identities strict and naked (rejecting `@`), optional delegates, and stops the reducer from rewriting usernames/agents—core event-model correctness across auth, ingest, APIs, and HTML display. B is a real, tightly scoped production fix (mandatory OAuth when creds exist, 401/403 refresh, no public www fallback, fly base URL), but it only touches the Reddit worker path versus A’s lasting domain contract.

Side A makes a broad architectural improvement by separating path normalization from identity parsing (`canonical_path.rs` and `identity.rs`), removing identity rewriting from the reducer, enforcing strict stored-form usernames/agent IDs without `@`, and updating APIs and event structures (including optional delegates) to use a consistent wire format. Side B is a solid operational bug fix—requiring OAuth when configured, refreshing tokens after 401/403, and improving Reddit error handling—but it is confined to one subsystem, whereas Side A establishes cleaner long-term boundaries and data invariants across the project.

Side A introduces the entire Reddit fetching subsystem from scratch (background worker, rate-limit/backoff, OAuth token handling, JSON parsing for posts/subreddits, wiring into AppState/UI, plus tests), representing substantial new lasting functionality. Side B is a smaller, valuable but incremental fix on top of that existing system (forcing OAuth, retry-on-401/403, error message cleanup), which is real but narrower in scope compared to the foundational architecture A establishes.

A replaces the Reddit placeholder with the full broker/worker design (OAuth, rate-limit/backoff, URL mapping, JSON parsers, AppState/browse integration, and tests), which is the lasting feature foundation. B is a focused production fix (force OAuth when creds exist, 401/403 refresh, error truncation, fly env pin) that hardens that path but adds comparatively little new architecture.

Side A adds the core Reddit integration: a background fetch broker, OAuth support, request deduplication and rate limiting, JSON parsing into project entities, wiring into application state, and triggering fetches from browsing and path creation. Side B is a targeted refinement that improves the existing integration by requiring OAuth when configured, refreshing tokens after 401/403 responses, and producing clearer error messages for Reddit's block pages, but it builds on the infrastructure introduced in Side A.

Commit A fixes a real production bug (Reddit blocking OAuth-required requests) with a targeted, well-tested retry/refresh mechanism and clear error surfacing. Commit B is a large URL-encoding refactor mixed with an unrelated YouTube-normalization feature; it changes room URLs to a less readable format (short+slug concatenated without separator) and touches many call sites/tests for cosmetic reasons, increasing churn risk without a clear necessity or bug motivation.

B delivers lasting platform design: centralized room path encoding (`room_route_segment` / fixed-width short id), route and href call-sites updated consistently, plus durable external URL identity normalization (YouTube shapes, sorted query pairs) with real tests. A is a strong, necessary production bugfix (require OAuth when creds exist, AuthRejected + forced refresh, no www.reddit.com fallback, fly.toml base URL), but it is narrower and confined to the Reddit worker path.

Side A fixes a concrete production reliability issue by requiring OAuth when credentials exist, adding token refresh-and-retry on 401/403 responses, improving error propagation instead of silently falling back, and adding targeted tests for error truncation. Side B is a broad URL/routing refactor that centralizes room path handling and adds URL normalization utilities, but much of the patch is mechanical call-site updates and route rewiring rather than addressing a specific correctness or availability problem.