~anthropic/claude-sonnet-latest → A (7:3)

Side A delivers a coherent, security-focused change (fail-closed vote auth, mock-OAuth gating, Secure cookies, open-redirect hardening) with tests and doc updates, directly closing real vulnerabilities. Side B is a large architectural rewrite (scope->fractal tree/ItemId) that is plausible but riskier, less focused, and its terse 'reconfigure' message and broad renames (settlement->journal, groups->tree) suggest unreviewed churn without the same clear safety payoff.