~x-ai/grok-latest → B (2:3)

B fixes foundational feed correctness by anchoring catch-up to durable ingest index (not wall-clock ms), so same-millisecond and clock-rollback posts are not missed, and adds room-scoped permission filtering plus multi-user private-room/revoke integration tests and a room field on FeedPost. A’s auth fail-closed votes, mock-OAuth gate, Secure cookies, and open-redirect hardening are real security wins, but they are more localized hardening/UI (nav alias) and dep pinning than B’s ledger semantics change.