openai/gpt-chat-latest → A (4:3)

Side A makes substantive security and correctness improvements: voting now fails closed instead of silently falling back to an anonymous actor, auth cookies gain the Secure flag when appropriate, mock OAuth is gated behind an environment flag, open-redirect sanitization is strengthened, and these behaviors are covered by tests. Side B fixes canonical tilde-path handling and root normalization across routing, ranking, and rendering with good regression tests, but its impact is narrower than the authentication hardening and session correctness changes in Side A.