c_e2ee16c7ada542f8c8

Side A merely deletes a speculative, AI-generated design markdown file with no code impact, contributing nothing functional. Side B is a substantive refactor that separates canonical-path normalization from identity parsing, fixes wire-format inconsistencies (stripping '@' from stored identifiers), makes delegate optional, and updates code, tests, and integration scripts consistently across the codebase.

Commit A only deletes an obsolete markdown architecture brainstorm (plan2.md) with no code impact. Commit B delivers a real structural refactor: extracts canonical_path.rs and identity.rs, enforces strict naked wire identities (no @/@@, optional delegate), slims the reducer/events layer so it no longer rewrites identities, and updates CLI, APIs, HTML display, types, and tests accordingly—lasting design clarity and API consistency.

Side B makes a substantial architectural improvement by separating path normalization into `canonical_path.rs` and identity parsing into `identity.rs`, removing identity rewriting from the reducer, enforcing strict stored-form identities without `@` in APIs, and updating ingest/auth flows to support optional delegates with validation. Side A only deletes a planning document (`plan2.md`) containing design notes and example code, without changing project behavior or implementation.

Side A is a substantial, coherent refactor that removes '@' sigil ambiguity from wire identities, splits canonicalization/identity concerns into dedicated modules, updates callers across server/CLI/tests, and adds regression tests validating the new invariant. Side B is a one-line placeholder file addition with no functional code, tests, or explanatory value.

Commit A is a substantive architectural refactor: it extracts canonical_path/identity modules, enforces strict stored-form wire identity (no @), makes delegate optional, and stops the reducer from rewriting identities—clear lasting design. Commit B only adds a one-line seed.tdsl (“open webui”) with no structural or corrective impact.

Side A introduces a substantive architectural refactor by separating identity parsing and path canonicalization into dedicated modules, enforcing strict stored-form identities without '@' in APIs, making delegate identity optional, and updating the reducer and API boundaries to stop rewriting identities. It also propagates these semantics consistently across authentication, ingest, feed, HTML display, types, and tests, whereas Side B only adds a one-line seed file containing "open webui" with no evident functional impact.

Side B is a substantive architectural refactor: it splits identity/path normalization into dedicated modules, removes double-canonicalization bugs (reducer no longer re-rewrites identity), fixes wire format inconsistencies (@ vs no-@ across JSON APIs), makes delegate optional for human-only ingests, and updates CLI/tests/docs consistently across the codebase. Side A is a smaller UI polish commit (vote counts on garden pins, unpin-via-HUD-form instead of link) with modest test/CSS additions but no structural or correctness improvement of comparable scope.

B is a lasting architectural cleanup: new canonical_path/identity modules, strict no-@ wire/storage forms, optional delegate on Ingest, and reducer that stops rewriting identity—touching API contracts, events, CLI, and tests consistently. A only adds localized garden UX (edge vote counts on vote icons, HUD unpin via set_garden_pin clear) plus CSS and a browser test, which is useful polish but far less structural.

Side B makes a substantial architectural change by separating path canonicalization and identity parsing into new `canonical_path.rs` and `identity.rs`, removing identity rewriting from the reducer, making delegate identities optional, and consistently enforcing stored-form usernames/agent IDs across APIs, CLI, types, and tests. Side A adds useful UI improvements (pairwise vote counts in the garden, an unpin action in the HUD, styling, and tests), but those are localized feature enhancements rather than a broad, lasting design improvement.

Side B is a substantial, correct architectural refactor (separating canonical_path/identity concerns, making delegate optional, standardizing wire identity to strip @ ambiguity) that touches many call sites consistently and is validated by updated integration tests, providing lasting clarity to a previously conflated events module. Side A is a well-tested but narrower heuristic tweak to pair-selection sub-priorities in one file, useful but of smaller architectural scope and impact than B's identity/API correctness overhaul.

A adds real pairing logic (established-component bridges before isolate–isolate, then rank-adjacent zip once connected) plus targeted tests in pair.rs, improving core ranking behavior. B mostly splits/moves canonicalize helpers, strips @ from wire/storage, and propagates optional naked delegates across many call sites—valuable API hygiene, but more contract/refactor churn than new lasting capability.

Side B makes a broad architectural improvement by separating canonical path handling from identity parsing, introducing dedicated `canonical_path.rs` and `identity.rs`, removing identity rewriting from the reducer, enforcing strict stored-form identities without `@` at API boundaries, and updating APIs, HTML, types, and tests consistently. Side A meaningfully improves pair selection with new bridge and rank-refinement heuristics plus targeted tests, but its impact is confined to one algorithm, whereas Side B establishes cleaner long-term boundaries and data handling across the project.

Side B is a coherent, testable identity refactor (splitting canonical_path/identity, making delegate optional, removing sigil-mangling in the reducer, plus new integration tests asserting rejection of '@') that fixes a real correctness/security concern in wire identity handling. Side A is a large mechanical rename (CanonicalItemUrl -> ItemId) that mostly shuffles code between files/modules without adding new capability, and even leaves an unfinished plan.md-driven refactor with fallback 'opaque' hacks that weaken the type safety it claims to add.

A replaces CanonicalItemUrl with a first-class ItemId across reducer maps, ranking, RPC, HTML routing, and types (new item_id/item_wire modules), which is a lasting core-domain design change. B’s split of path/identity helpers, no-@ wire form, and optional delegate improve API boundaries and module hygiene, but they are narrower contract/layering cleanups than A’s graph-wide identity migration.

Side A introduces a new structural `ItemId` type, extracts shared wire-normalization into `item_wire`, and propagates the new identity model through reducer state, ranking, routing, HTML, RPC, and tests, replacing pervasive `CanonicalItemUrl` usage with a stronger abstraction. Side B usefully separates identity and path normalization into dedicated modules and cleans up API semantics around usernames/delegates, but it is primarily an architectural reorganization and wire-format adjustment rather than the broad foundational data-model change implemented in Side A.

Both are refactors, but B fixes a real design flaw (identity rewriting scattered/duplicated across reducer and events, ambiguous @ sigil handling, agent required even for human-only ingests) with a clean split into identity.rs/canonical_path.rs, consistent wire-form contracts, and updated tests/integration scripts proving the new behavior end-to-end. A introduces a plausible composable url_rules engine but is mostly a large mechanical find-replace of test fixtures from bare hostnames to https:// URLs, with the actual new engine/registry code being sizable but less proven by broad test coverage across the whole system (CLI, api, html, bb integration tests) as B demonstrates.

A adds a real domain subsystem (`url_rules` engine/registry) and redesigns `ItemId` around full canonical URLs with parent/breadcrumb rules and multi-site normalization (Reddit/YouTube), which is lasting core design. B mostly splits existing helpers into `canonical_path`/`identity`, drops `@` from wire forms, and makes delegate optional—valuable API hygiene, but largely reorganization plus contract tightening rather than new capability.

Side A introduces a substantial URL identity architecture: a new composable `url_rules` module, canonical full-URL `ItemId`s, centralized canonicalization/parent/breadcrumb logic, replay support, and updates projection, Reddit integration, and storage parsing to use the new canonical identities. Side B is primarily a refactor separating identity and path normalization plus changing wire formats (removing `@` from stored/API identities and making delegates optional), which improves organization and API consistency but is less foundational than the new canonical URL system and normalization behavior added in Side A.

Side B fixes concrete security bugs: fail-closed vote resolution (previously any missing/expired session silently fell back to anonymous voting), gating mock OAuth behind an env flag, adding Secure cookie flags over HTTPS, closing an open-redirect vector in return_to sanitization, and pinning the `durable` git dependency to a rev instead of a floating branch. Side A is a large, mostly mechanical reorg (splitting canonical_path/identity modules, dropping `@` from wire form) that improves clarity but is lower-stakes churn compared to B's genuine auth-hardening fixes.

B’s fail-closed vote auth (no anon fallback), mock-OAuth env gate, Secure cookies, and tighter return_to sanitization are concrete security/correctness fixes with durable effect; A mostly relocates path/identity helpers and propagates a wire-format/@ convention change across many call sites. A’s module split and optional delegate are useful structure, but B delivers more necessary lasting value per change.

Side A introduces a lasting architectural separation by extracting `canonical_path.rs` and `identity.rs`, removing identity rewriting from the reducer, standardizing stored/wire identities without `@`, making delegates optional, and updating APIs and tests to enforce validated stored-form identities. Side B contains worthwhile security hardening—failing closed on unauthenticated voting, gating mock OAuth, adding Secure cookie handling, and tightening redirect validation—but its scope is narrower than A's broad cleanup of identity handling and normalization invariants across the project.

Side A introduces a full RPC batch architecture (rpc.rs, room/scope model, CLI Public/Private commands) that meaningfully restructures the API surface and adds real new capability (rooms, batched calls, scoped garden/forum access), backed by substantial test and integration updates. Side B is a narrower, cleaner refactor (identity/canonical_path split, dropping '@' sigils) that improves code hygiene but has smaller lasting architectural impact than A's broader system redesign, even though A's diff is messier and less polished in places (e.g. leftover unused variables, more surface area to maintain).

Commit A is a major architectural change: it consolidates REST into a batch RPC API, introduces room/scope separation (RoomCreated vs ThreadCreated, room_id+thread_tag on Ingest, scoped forum indexes), and rewires the CLI and tests around multi-room access. Commit B is valuable but narrower—extracting canonical_path/identity and enforcing naked wire identities without @—and much of A’s surface already assumes those identity rules.

Side A replaces many individual REST endpoints with a unified RPC batch interface (`/api/v0/rpc`), updates the CLI to use it, introduces room-scoped commands (`public`/`private`), and restructures reducer/events to separate rooms from forum threads (`room_id` plus `thread_tag`), which is a substantial architectural change touching client, server, tests, and data model. Side B is a useful cleanup that extracts canonicalization/identity parsing into dedicated modules and enforces stored-form identities without `@`, but it is primarily a refactor and validation improvement rather than introducing comparable new project capabilities.

Side A performs a substantial, well-scoped identity/API refactor (new canonical_path.rs and identity.rs modules, strict wire-format validation without '@', reducer no longer rewrites identity, delegate becomes optional) with matching test and CLI updates across many call sites, fixing real correctness/design issues. Side B is a smaller mixed change: it removes a 'demo counter' feature and adds an async settlement worker with cached ranking scores, which is a reasonable perf/architecture improvement but is narrower in scope and partly consists of deleting throwaway demo code rather than fixing core design flaws.

A delivers a lasting identity/API design: split path vs identity modules, strict naked wire forms, optional delegate, and stop rewriting identities in the reducer—foundational across CLI, events, APIs, and HTML. B’s settlement worker and cached ranking reads are real systems improvements, but much of the patch is demo-counter deletion and local UI plumbing with narrower product impact.

Side A introduces a substantial architectural separation by moving path normalization into `canonical_path.rs` and identity parsing into `identity.rs`, removes identity rewriting from the reducer, enforces strict stored-form usernames/agent IDs across APIs, and makes delegate handling optional, with corresponding updates throughout server, CLI, types, and tests. Side B improves performance and design by removing the demo counter, adding a settlement worker with cached ranking computation (`settlement.rs` and `ranked_items_cached`), but its scope is narrower than A's project-wide normalization and API consistency changes.

Side A is a large mechanical refactor (splitting identity/canonical_path modules, changing wire formats) that mostly moves code around and changes conventions without fixing a functional bug, and even touches many call sites/tests for stylistic consistency. Side B is a small, precise bugfix that correctly reorders a guard to prevent ghost items and incorrectly-marked voted pairs in the ranking reducer, fixing a real correctness issue with a targeted, verifiable test update. Despite A's larger footprint, B delivers more durable, unambiguous value per line changed.

B fixes a real reducer correctness bug: zero-ratio votes used to run ensure_item and voted_pairs.insert before the early return, leaving ghost items and false voted pairs; the guard is moved before any side effects and the test now asserts empty index/edges/pairs. A is a large identity/path split and wire-format sweep (no @, optional delegate, module moves) that improves structure but is mostly reorganization and mechanical API/test churn relative to B’s lasting state-fix.

Side A introduces a lasting architectural separation by extracting path normalization into `canonical_path.rs` and identity parsing into `identity.rs`, removes identity rewriting from the reducer, standardizes stored/wire identities without `@`, makes delegate identities optional, and updates APIs, HTML, CLI, and tests to consistently enforce those semantics. Side B fixes a real reducer bug by moving the zero-ratio early return before `ensure_item` and `voted_pairs.insert`, preventing ghost items and false voted pairs, but it is a narrowly scoped correctness fix compared with Side A's broader, durable redesign.

Side B is a genuine architectural cleanup: it separates identity/canonicalization concerns into dedicated modules, fixes a real inconsistency (identity rewriting scattered across reducer/events), removes dead double-@ sigil confusion, and makes the delegate optional with proper validation, backed by updated tests across CLI, server, and integration suites. Side A is mostly infrastructure/deploy scaffolding (Dockerfile, fly.toml, CI) plus a large CSS/JS dashboard UI bolted onto one file, which is useful operationally but adds more incidental complexity and less durable architectural value than B's identity refactor.

A ships production deploy (Docker/Fly/CI), multi-repo roots, and a real audit/SSE/status/watch path with tests and emission-loop hardening—net new lasting capability. B is a worthwhile identity/path split and wire-contract cleanup (optional naked delegate, no reducer rewriting), but mostly reorganizes and ripples existing behavior rather than adding comparable operational surface.

Side B makes a lasting architectural change by separating path normalization (`canonical_path.rs`) from identity parsing (`identity.rs`), removing identity rewriting from the reducer, enforcing strict stored-form usernames/agent IDs, and updating APIs so wire formats are consistent while HTML alone adds `@`/`@@` for display. Side A adds valuable deployment infrastructure, production configuration, and a live audit dashboard with SSE/status endpoints, but much of its patch is operational/UI work rather than the core data-model and API correctness improvements introduced in Side B.

Side A vendors a whole speculative RocksDB abstraction crate (with docs, examples, benchmarks, licenses) plus a huge dependency/Cargo.lock churn, but the actual integration into the server is thin (one entity_store wrapper) and the streaming replay refactor is modest; much of the diff is generated noise rather than durable design. Side B is a focused, coherent refactor that removes ad-hoc identity canonicalization scattered across events/reducer, introduces clear identity.rs/canonical_path.rs modules, fixes wire-format inconsistencies (@ handling), and updates tests/CLI/docs consistently, yielding a cleaner, more correct codebase with less risk and less bloat.

Commit A delivers lasting architectural value by introducing a full RocksDB-backed durable crate, offloading entity JSON payloads out of the in-memory GlobalTree into EntityStore, and replacing bulk event load with true line-at-a-time replay to cut startup RAM. Commit B is a worthwhile but narrower refactor that extracts canonical_path/identity modules and enforces naked stored-form identities on the wire; it improves modularity and API consistency without adding comparable runtime capability or resource wins.

Side A introduces substantial new infrastructure: a new RocksDB-backed `durable` workspace crate, an `EntityStore` that moves raw Reddit JSON out of in-memory state, and streaming event-log replay via `EventLog::replay`, reducing startup memory while preserving functionality. Side B is a worthwhile architectural refactor that separates path normalization and identity parsing, enforces stored-form identities without `@`, and updates APIs accordingly, but it primarily reorganizes validation and representation rather than adding comparable runtime capabilities.

Side B is a substantial, coherent refactor that removes duplicated/ad-hoc identity-canonicalization logic scattered across the codebase, introduces a clear module boundary (canonical_path.rs, identity.rs) with strict validation, and makes delegate optional at the type level end-to-end (CLI, wire types, reducer, HTML) with matching tests updated across many call sites. Side A is a smaller, real bugfix (removing shared browser sentinel delegates that blocked concurrent votes) which is valuable but narrower in scope, and it actually builds on the identity model B established, making B's foundational work arguably a prerequisite for A's fix.

B is a lasting identity redesign: optional naked delegates, strict no-@ wire form, identity/canonical_path split, and a reducer that stops rewriting principals—foundational across ingest, APIs, CLI, and HTML. A is a high-value but narrower follow-on bugfix (drop shared WEB_BROWSER_AGENT sentinels, Option agent on pending sessions, multi-user vote test) that depends on that model rather than establishing it.

Side A fixes a concrete correctness bug by replacing shared browser sentinel delegates with `None` for web sessions, preventing erroneous `AgentBound` collisions so multiple human users can vote independently. It updates the pending-session model, HTML attribution, CLI polling, and adds an end-to-end integration test verifying two different browser users can vote without creating delegate bindings, whereas Side B is primarily a broad refactor of identity/canonicalization and API conventions with comparatively less direct functional impact.

Side B is a real security/design fix: an XSS-critical bug where the reducer was silently mangling stored identity strings (double-canonicalizing usernames/agents), replaced with strict parse-at-the-boundary validation, consistent wire format, optional delegates, and updated tests across CLI/server/integration suites. Side A adds a genuinely useful sanitize-on-render fix for untrusted HTML but is a much smaller, single-purpose patch mostly composed of a large auto-generated Cargo.lock diff for a new dependency, with limited actual logic (one small module plus two call-site edits).

B delivers a lasting architectural cleanup: split identity/canonical_path modules, make wire/storage form strict (no @ rewriting in the reducer), optional delegates, and consistent API/HTML separation across many call sites. A is a correct, necessary XSS harden (ammonia + small sanitize helper + tests) but narrower in scope than B’s model and boundary changes.

Side A fixes a concrete security vulnerability by introducing Ammonia-based sanitization for untrusted Reddit `body_html` before `maud::PreEscaped` rendering, wiring it into both render paths and adding tests that verify scripts and event handlers are stripped while benign markup is preserved. Side B is a broad refactor that separates identity and path canonicalization and changes API conventions (stored-form usernames, optional delegates), but it is largely structural and behavioral cleanup rather than delivering a comparably critical, lasting user-facing improvement.

Side A performs a genuine architectural cleanup: separating identity parsing/validation into a dedicated module, removing ad-hoc identity rewriting from the reducer, making delegate optional, and consistently updating wire/HTML boundaries with matching test and CLI updates across the whole codebase. Side B is a solid, scoped bugfix (forcing OAuth and retry-on-401/403 for Reddit fetches) with good error truncation and a test, but it's narrower in scope and impact compared to A's broader identity-model correctness fix that touches API contracts, storage, and display logic throughout the system.

A permanently separates path vs identity concerns, makes wire/storage identities strict and naked (rejecting `@`), optional delegates, and stops the reducer from rewriting usernames/agents—core event-model correctness across auth, ingest, APIs, and HTML display. B is a real, tightly scoped production fix (mandatory OAuth when creds exist, 401/403 refresh, no public www fallback, fly base URL), but it only touches the Reddit worker path versus A’s lasting domain contract.

Side A makes a broad architectural improvement by separating path normalization from identity parsing (`canonical_path.rs` and `identity.rs`), removing identity rewriting from the reducer, enforcing strict stored-form usernames/agent IDs without `@`, and updating APIs and event structures (including optional delegates) to use a consistent wire format. Side B is a solid operational bug fix—requiring OAuth when configured, refreshing tokens after 401/403, and improving Reddit error handling—but it is confined to one subsystem, whereas Side A establishes cleaner long-term boundaries and data invariants across the project.

Side A is a disciplined, well-motivated refactor that fixes real correctness issues (strict wire-identity validation, optional delegate, removing ad-hoc reducer-side identity rewriting) and updates the entire call graph and test suite consistently across CLI, server, and types crates. Side B adds a genuinely useful Reddit-fetch feature with reasonable async/rate-limit design and tests, but the commit is poorly scoped/labeled ('reddit'), bundles unrelated changes (.gitignore, duplicate reqwest dependency, a stray 'todo' file), and is less clearly integrated with lasting architectural clarity.

A permanently hardens core identity/API design: splits path vs identity modules, makes wire form naked (no @), optional delegate, and stops the reducer from rewriting principals/agents—contract and correctness across auth, ingest, feed, and types. B replaces a reddit stub with a real broker/OAuth/rate-limit fetch path, but that is an additive integration on browse/tree rather than a foundational domain fix.

Side A introduces a substantial architectural refactor by separating path normalization into `canonical_path.rs` and identity parsing into `identity.rs`, removing identity rewriting from the reducer, making delegate identities optional, and consistently enforcing stored-form usernames/agent IDs across APIs with validation. Side B adds a useful Reddit background fetch worker with OAuth, rate limiting, and lazy fetch triggering, but it is a narrower feature addition compared with A's broad cleanup of identity semantics and API/storage invariants that affects core project design.

B fixes a concrete production bug (shared sentinel delegate blocking multi-user voting) with a targeted, well-tested change including a regression test proving two users can vote independently. A is a larger refactor (splitting identity/canonical_path modules, dropping @ from wire format) that improves clarity but is mostly reorganization/renaming without fixing a live user-facing defect, and its scope makes correctness harder to fully verify despite the added tests.

B fixes a concrete production bug: shared WEB_BROWSER_AGENT/INVITE_BROWSER_AGENT sentinels caused AgentBound on the first browser vote and blocked every later human, and it removes those sentinels so UI posts use delegate None with a multi-user regression test. A is a large identity/path split (canonical_path + identity, strict no-@ wire form, optional delegate, reducer stops rewriting) that improves lasting design and enables optional delegates, but much of the diff is mechanical call-site/test churn versus B’s narrower correctness win.

Side A introduces a durable architectural separation by extracting identity parsing (`identity.rs`) and path normalization (`canonical_path.rs`), removing implicit identity rewriting from the reducer, changing delegates to `Option<String>`, and enforcing strict stored-form identities across APIs while keeping HTML-specific `@` rendering. Side B fixes a real multi-user bug by eliminating shared browser sentinel delegates and adding strong regression tests, but it is a focused follow-up built on the broader identity model established in Side A.

Side B fixes a real correctness bug (implicit feed cutoffs using timestamps instead of durable ingest order, causing missed/leaked posts across concurrent multi-user activity and private-room visibility), backed by substantial targeted integration tests proving the fix. Side A is a large but mostly mechanical refactor (renaming/moving canonicalize functions, dropping '@' sigils in wire format) that improves code organization but fixes no functional bug and touches many files for consistency rather than solving a concrete defect.

B fixes real feed catch-up correctness and privacy bugs by anchoring on durable ingest order (not ms timestamps) and enforcing multi-user private-room visibility, backed by focused integration tests for collisions, clock rollback, and revoked grants. A is a broad worthwhile split of path vs identity and strict no-@ wire form, but much of the diff is module moves, call-site churn, and API convention updates rather than new behavioral guarantees.

Side B fixes a correctness issue in feed catch-up by anchoring implicit feeds to durable ingest order instead of timestamps, preventing missed posts when timestamps collide or move backwards, and filters results through permission checks to avoid leaking revoked private content. The patch also factors feed generation into a shared `rpc_feed` helper and adds targeted integration tests covering multi-user timestamp collisions and private-room visibility, whereas Side A is largely a broad API/identity refactor with behavior and representation changes rather than a focused correctness improvement.

Side A performs a broader architectural cleanup: splitting canonical_path/identity concerns, enforcing strict wire-form validation (rejecting `@` in API input), and consistently updating CLI/server/tests/types to match, which reduces ambiguity and hardens the API surface. Side B fixes a real but narrower bug (tilde ontology root normalization) with good test coverage, but its scope and lasting design impact are smaller than A's systemic identity/wire-format rework.

A delivers a lasting cross-cutting design: strict stored-form wire identity (no `@`), optional delegate, identity validation moved out of the reducer, and clean module splits (`identity` / `canonical_path`) applied through APIs, CLI, and types. B is a real, focused correctness fix (unify `https://slug.social/~` vs `…/~/` so garden root child lookups work) with solid tests, but it is narrower path-key normalization rather than a system-wide contract improvement.

Side A introduces a substantial architectural improvement by separating path normalization into `canonical_path.rs` and identity parsing into `identity.rs`, removing identity rewriting from the reducer, enforcing strict stored-form usernames/agent IDs at API boundaries, and making delegates optional throughout ingest and event handling. Side B fixes a real bug around canonical ontology root paths (`https://slug.social/~` vs `.../~/`), normalizes storage keys, and adds strong regression tests, but its impact is narrower and focused on one path-normalization issue rather than the broader API and data model redesign in Side A.