c_effff18688f9eeba84

Side A fixes a real XSS vulnerability by sanitizing untrusted Reddit HTML before rendering, a small, precise, security-critical change with tests. Side B is a large refactor consolidating POST /post, /post/check, /post/redact into a single /ui RPC endpoint—useful cleanup but riskier, sprawling, and not addressing a correctness/security defect.

A adds a real, lasting XSS defense (ammonia whitelist + tests) for untrusted Reddit HTML embedded via PreEscaped, fixing a concrete security hole at the render sites. B is a worthwhile unification of /post* into the /ui RPC path and deletion of web_post.rs, but it is mostly moving and rewiring existing logic without new protective or functional substance.

Side A fixes a concrete security vulnerability by introducing Ammonia-based sanitization for untrusted Reddit `body_html` before `maud::PreEscaped` rendering, adds a reusable `entity_body_html` helper, and includes tests verifying scripts and event handlers are stripped while benign markup is preserved. Side B is primarily a large refactor that consolidates `/post*` flows into `/ui`, moves code, and changes routing and form submission patterns, but it mostly reorganizes existing behavior rather than adding comparable enduring functionality.

Side A performs a substantive architectural consolidation: it removes the redundant web_post.rs endpoints (/post, /post/check, /post/redact), unifies all browser mutations behind the single POST /ui + __rpc__ dispatch, introduces a session-resolution helper (WebSession/resolve_web_session) to avoid duplicate header/cookie parsing, and updates templates, JS, tests, and fixtures to match—an end-to-end simplification of the routing surface. Side B is a much smaller, localized cleanup that trims unused parameters/logic from vote_compare_post_success_js and removes a dead card-render call, which is useful but minor in comparison.

A consolidates browser ingest/check/redact onto a single POST /ui path: adds WebSession/resolve_web_session, deletes web_post.rs and the /post* routes, inlines dispatch through RPC, and updates forms, client check JS, and tests—lasting structural cleanup. B only trims unused args and drops a #vote-compare-preview morph in vote_compare_post_success_js, a small local simplification with little design impact.

Side A consolidates the browser posting flow behind a single `POST /ui` RPC endpoint, introduces `resolve_web_session` to resolve username and bearer once, removes the duplicated `web_post.rs` handlers, updates forms, routes, and tests, and preserves functionality while simplifying the architecture. Side B is a narrow cleanup that removes unused parameters and an unnecessary preview update from `vote_compare_post_success_js`, improving maintainability but with much smaller project-wide impact.

Side B is a genuine refactor that consolidates duplicated web_post.rs logic into ui_html.rs, removes now-dead /post routes, introduces a cleaner WebSession abstraction, and updates tests/fixtures accordingly—reducing code duplication and clarifying the dispatch path. Side A adds a real feature (vote page, typed form holes) but is messier: it bundles unrelated dependency additions (rand, urlencoding, zerocopy chain) into Cargo.lock, references an undefined vote module in the diff, and mixes CSS/JS additions with backend logic without clear architectural improvement.

A adds lasting product capability (child vote CTA, /vote flow, preference slider JS/CSS) plus reusable typed `$form:i32` substitution and a `next` redirect on record_vote, with tests. B is a worthwhile consolidation—folding web_post into POST /ui, WebSession, and __rpc__ forms—but mostly relocates existing ingest/check/redact behavior rather than net-new design or fixes.

Side B performs a substantial architectural refactor by consolidating web posting, checking, and redaction into the unified `/ui` RPC flow, introducing shared `WebSession` resolution, removing the duplicated `web_post.rs` implementation, and updating forms, routes, and tests accordingly. Side A adds useful functionality such as typed `i32` form holes, vote navigation, and UI support, but much of the patch is dependency updates and incremental feature work rather than the broad simplification and maintenance improvement delivered by Side B.

Side B consolidates three parallel legacy POST endpoints (/post, /post/check, /post/redact) into the single /ui RPC dispatch path, removing duplicated auth/session logic (web_post.rs deleted entirely) and updating tests/fixtures accordingly—this is a substantive architectural simplification with real behavioral consolidation. Side A mainly swaps a cookie-based theme system for a /~/ URL-based browse route and deletes CSS themes, which is a reasonable but narrower and more cosmetic refactor (URL scheme change plus theme removal) with less overall reduction in duplicated logic.

Commit A lands a lasting navigation design: ItemId browse_href/from_browse_uri (with https:/ normalization and tests), a /~/ route, and call-site cleanup—plus real simplification by dropping the theme cookie/CSS stack. Commit B is valuable consolidation (fold web_post into POST /ui, WebSession, form __rpc__ migration) but mostly relocates existing ingest/check/redact behavior rather than adding comparable core design.

Side A introduces a new canonical browse URL scheme (`/~/...`) with `ItemId::browse_href`, parsing helpers, routing, and integration tests, replacing ad hoc query-string links and centralizing URL generation. Although it also removes theme support, the core change establishes a cleaner navigation design reused across the UI. Side B mainly refactors existing web post/check/redact flows into the `/ui` dispatcher and consolidates session handling, improving structure but with less new end-user capability.

Side A performs a substantive refactor that eliminates a whole duplicate code path (deletes web_post.rs), unifies session resolution and RPC dispatch into a single `/ui` handler, and updates tests/fixtures accordingly to match the new contract — a meaningful architectural consolidation. Side B is a useful but narrower fix (replacing hardcoded hostnames with a shared `get-base-url` helper and switching deploy branch), which improves correctness for multi-environment deploys but touches many files with mechanical, low-complexity changes rather than restructuring core logic.

A completes a lasting API consolidation: delete web_post.rs and the /post|/post/check|/post/redact routes, resolve session once via WebSession/resolve_web_session, and route all forum compose/redact through POST /ui + __rpc__ (forms, client check JS, integration/walkthrough tests). B is a real but narrower ops fix—centralize get-base-url/HOSTNAME, point OAuth callbacks and authUtils at that base/origin, and retarget Fly deploys to staging—valuable durability without restructuring product surface area.

Side A performs a substantial architectural consolidation by moving browser posting, checking, and redaction into a single `POST /ui` dispatch, introducing `resolve_web_session` to avoid repeated auth parsing, removing the separate `web_post` module, updating forms and tests to the new `__rpc__` flow, and preserving behavior through shared helpers. Side B is a useful configuration and portability fix—centralizing base URL resolution with `util/get-base-url`, using `window.location.origin`, and updating the deployment workflow—but its scope is limited to redirect/deployment correctness rather than a broad, lasting simplification of the application's request handling.

Side B consolidates three duplicated endpoints (/post, /post/check, /post/redact) into the single /ui RPC dispatch path, removing ~350 lines of near-duplicate handler code and unifying session resolution, which is a real architectural simplification with test/fixture updates to match. Side A introduces a large new hierarchical ItemId/tree model (also substantial and well-tested), but it's a bigger, less proven refactor with more speculative surface (breadcrumbs, entity panels, reddit.rs stub) versus B's more contained, verifiably correct consolidation.

Commit A replaces flat string scopes with a hierarchical GlobalTree/ItemId model, path canonicalization, breadcrumbs, journaled votes, and node ensure events—core lasting domain design. Commit B mainly consolidates existing /post* handlers into POST /ui (delete web_post.rs, rewire forms/tests), which cleans the API but mostly relocates behavior without comparable architectural depth.

Side A introduces a substantive new hierarchical data model centered on `ItemId` and `GlobalTree`, migrates voting from flat scope strings to parent-node rankings, adds canonical Reddit URL parsing, breadcrumb navigation, node persistence (`NodeEnsured`), and a journal worker that updates the tree after durable event logging. Side B is primarily a refactor that consolidates existing `/post` endpoints into the `/ui` RPC flow, factors out shared session resolution, and rewires forms and tests; while it reduces duplication and simplifies routing, it mostly reorganizes existing behavior rather than adding comparable long-term functionality.

Commit A deletes ~1800 lines of an unreliable, over-engineered keystroke-transition-graph parser and replaces it with a small, testable, correct URL-parsing function plus a simpler paste-and-go UI, genuinely simplifying the codebase and fixing a real reliability problem (also removing an entire flaky browser-race test). Commit B is a legitimate consolidation of POST /post, /post/check, /post/redact into a single /ui RPC endpoint with shared session resolution, which is solid but more mechanical refactor/plumbing with less net risk reduction and more residual duplication (e.g., duplicated helper functions) than A's decisive cleanup.

A deletes an unreliable ~1.8k-line keystroke graph parser plus race-handling JS/Playwright and replaces it with a small, correct paste-and-go subreddit extract/redirect that matches real product need. B is a solid consolidation (fold web_post into POST /ui, WebSession once, form __rpc__), but it mostly relocates existing ingest/check/redact behavior rather than fixing a broken design.

Side B performs a substantive architectural consolidation by moving posting, checking, and redaction workflows behind the existing `POST /ui` RPC mechanism, introducing `resolve_web_session` to avoid repeated authentication parsing, deleting the separate `web_post` module, and updating forms and integration tests accordingly. Side A simplifies an unreliable autocomplete graph into a paste-and-go URL parser with redirect behavior and removes a large amount of parser complexity, but it also drops richer navigation/autocomplete functionality in favor of a narrower workflow, making its long-term design impact somewhat less broadly beneficial.

B consolidates duplicate POST /post, /post/check, /post/redact endpoints into the single /ui RPC path, deleting an entire redundant module (web_post.rs) and unifying session resolution, which is a real architectural simplification with test/integration updates confirming the migration. A adds a legitimate feature (fullscreen compare view, sorted edge history, post-vote preview) but is more localized UI polish with some added complexity (new sorting/ratio helper functions) rather than removing duplication.

B permanently consolidates browser ingest/check/redact onto a single POST /ui path (WebSession, dispatch_ui_action), deletes the whole web_post module and /post* routes, and rewires forms/tests to __rpc__—lasting architectural simplification. A improves one page (chromeless fullscreen layout, edge-history sort/ratio orientation, preview morph) with real UX value, but its impact stays localized versus B’s system-wide cleanup.

Side B performs a substantial architectural consolidation by moving browser posting, checking, and redaction into the unified `POST /ui` `HtmlUiAction` flow, introducing `WebSession` resolution, removing the separate `web_post.rs` implementation, updating forms and client-side checks to use `__rpc__`, and adapting integration tests. Side A mainly improves the vote-compare UI with a fullscreen layout, preview morph, reordered edge history, and related styling/tests, which is valuable but more feature-focused and less foundational than the routing and request-handling refactor in B.

Commit A delivers substantial new functionality: cookie-based web sessions, a login/logout flow, private room routing (/r/:short/:slug/...), room-scoped thread views with ACL checks, and a full web posting handler — real, functional feature additions. Commit B is a refactor that consolidates existing /post endpoints into a single /ui RPC dispatcher, which is reasonable cleanup but net-negative in some spots (e.g., includes stray irrelevant plan2.md-adjacent content isn't here, but B's diff shows leftover TODOs and duplicate JSON-building boilerplate), making it useful but comparatively lower-impact than A's feature buildout.

Side A lands the foundational room UI: cookie sessions, web login/logout, POST ingest, ThreadNav, ACL-gated private room pages/routes, and compose forms that wire the forum for multi-tenant use. Side B is mostly a downstream refactor that deletes web_post, collapses /post*/check/redact into /ui, and moves the same handlers plus form templates—useful consolidation but little new product capability relative to A's feature surface.

Side A delivers substantial new functionality: browser session cookies, login/logout flow, web posting, room-aware thread views, private room access checks, new routes, and reusable helpers such as `rpc_post_with_bearer`, fundamentally restoring and expanding the web UI. Side B is primarily a refactor that consolidates `/post`-style handlers into a single `/ui` dispatch (`resolve_web_session`, moving logic from `web_post.rs` into `ui_html.rs`) and updates forms/tests to use `__rpc__`, improving organization but adding comparatively little new behavior.

Side A eliminates a duplicated web_post.rs module by unifying all /post, /post/check, /post/redact logic into a single /ui dispatcher with one shared session-resolution helper, removing ~360 lines of parallel/duplicate logic and updating tests and fixtures to match — a genuine architectural consolidation with lasting maintainability benefit. Side B is a set of narrower, real fixes (out-of-band delegate attribution, stricter vote-pool fallback, dead swap button removal, route rename) that are correct but smaller in scope and impact compared to A's structural DRY-up of the entire web ingest/check/redact pipeline.

A consolidates browser ingest/check/redact onto a single POST /ui dispatcher, deletes the duplicate web_post module and routes, and adds shared WebSession resolution—lasting architectural simplification used across forms and tests. B’s vote fixes (out-of-band WEB_BROWSER_AGENT delegate, no fallback when pool < 2) are real correctness wins but narrower, and much of the diff is route rename plus removing the swap button.

Side A consolidates the browser posting flow into a single `POST /ui` RPC-based dispatch, introduces `resolve_web_session` to avoid repeated auth/session extraction, removes the redundant `web_post.rs` handlers, updates forms, routes, and tests, and centralizes shared logic—an architectural simplification with broad, lasting impact. Side B contains useful but narrower fixes: passing browser attribution out-of-band via `delegate_opt`, preventing an incorrect fallback when too few sibling items exist, removing a redundant UI button, and renaming `/vote/compare` to `/vote`, but these are incremental compared with A's substantial refactor.

Side A adds a self-contained, tested feature (garden ranking markdown copy) with unit tests, integration test, browser test, and docs, following an existing pattern cleanly. Side B is a genuine architectural consolidation (merging /post, /post/check, /post/redact into /ui) which has real value but is riskier/broader churn with less test coverage added relative to the surface area touched, and includes a stray TODO comment signaling incompleteness.

B permanently unifies browser ingest/check/redact onto POST /ui (deletes web_post.rs and the /post* routes, introduces WebSession, rewires forms/tests), which is lasting architectural simplification. A adds a useful copy-rankings control with solid tests, but it is an incremental feature on an existing JsBuilder pattern rather than a structural improvement.

Side B performs a substantial architectural refactor by consolidating browser posting, checking, and redaction into the unified POST /ui RPC flow, introducing shared WebSession resolution, removing the separate web_post module, updating forms and routes, and adapting tests. Side A adds a useful end-user feature—a clipboard copy button for garden rankings with markdown formatting, UI wiring, permission checks, and tests—but its impact is narrower than the broader simplification and unification of the web interaction layer in Side B.

Side A performs a genuine architectural consolidation: it removes a 362-line duplicated web_post.rs module, unifies three separate POST endpoints into a single RPC-dispatched /ui handler with a shared session-resolution helper, and updates all call sites (routes, templates, integration tests, fixture) consistently. Side B mostly deletes legacy fallback branches in one file (constitution.py) for cleanliness, which is useful but narrower in scope and forces a production ledger wipe due to now-required Emission fields, making it a riskier, less self-contained change than Side A's thorough end-to-end dedup.

A completes a real architectural migration: deletes the separate `/post` stack and `web_post.rs`, consolidates auth into `resolve_web_session`/`WebSession`, and routes browser ingest/check/redact through a single `POST /ui` + `__rpc__` path with matching HTML/JS and tests. B is a worthwhile correctness cleanup (drop GitDiscovery legacy projection, require Emission evidence fields), but it is mostly deletion of display fallbacks rather than a multi-surface design change of comparable scope.

Side B removes the legacy GitDiscovery projection path and makes the evidence model authoritative by requiring emission metadata, deleting fallback lookup code, and simplifying epoch/commit pages to rely only on Evidence events. This is a substantive architectural cleanup that eliminates dual data paths and updates tests accordingly, whereas Side A is largely a large-scale refactor consolidating web posting into the `/ui` RPC flow with mostly equivalent behavior moved between modules.

Side B fixes a real correctness bug (RwLock guard held across a match arm, invitable to deadlock, in RoomCreate/RoomGrant handlers) plus flaky-test root causes (missing HTTP timeouts, pipe-buffer deadlock in test harness log capture), all concrete and lasting improvements to reliability. Side A is a large structural refactor that consolidates duplicate web_post.rs handlers into a single /ui dispatcher and unifies session resolution, which is a reasonable cleanup but mostly moves/renames existing logic without fixing any bug, and its size is largely churn (route removal, JSON templating changes) rather than a necessary fix.

B fixes real tokio RwLock deadlocks in RoomCreate/RoomGrant by dropping read guards before nested lock acquires, plus complementary test infra (log-file pipes, HTTP timeouts) that prevents related hangs—correctness that keeps RPC usable. A is a large but mostly consolidating refactor (delete web_post.rs, fold ingest/check/redact into POST /ui and form __rpc__), valuable design cleanup without the same defect-level impact.

Side A performs a substantial architectural consolidation by moving browser posting, checking, and redaction into a single POST /ui dispatch path, introducing a shared WebSession resolver to avoid repeated auth lookups, removing the separate web_post module, and updating HTML, routing, and integration tests to use the unified RPC-style interface. Side B fixes a real correctness issue by shortening RwLock read-guard lifetimes to avoid deadlocks in RoomCreate/RoomGrant and adds regression coverage, but its scope is limited to a specific locking bug whereas Side A delivers a broader, lasting simplification of the web API structure.

B consolidates three separate POST endpoints into a single /ui dispatch path, removing ~360 lines of duplicated auth/session-resolution logic while preserving behavior (verified by updated integration tests and fixture), a genuine architectural simplification with real test coverage. A adds a legitimate feature (Reddit post rendering with image/link extraction and a new render module) with a unit test, but it's narrower in scope and mostly additive rather than resolving existing duplication/tech debt.

A adds lasting product capability: EntityData gains image_url/link_url with real Reddit preview/link parsing, a dedicated render::reddit path for post cards/thumbnails, CSS, and a fixture-backed test. B mainly consolidates already-working web ingest/check/redact onto POST /ui by deleting web_post.rs and rewriting callers/tests—valuable cleanup, but largely relocation of existing behavior rather than new design substance.

Side A adds substantial new end-user functionality: Reddit-specific rendering for entity pages and ranking lists, extends `EntityData` with `image_url` and `link_url`, implements robust extraction of preview/full-image URLs while avoiding unsuitable Redgifs links, and adds a regression test fixture. Side B is primarily an architectural refactor that consolidates web posting flows into `POST /ui` and removes duplicate handlers; while useful for maintainability, it mostly reorganizes existing behavior rather than adding comparable lasting capabilities.