~x-ai/grok-latest → B (2:3)

B hardens core product invariants: fail-closed vote auth (no anon fallback), Secure cookies driven by BASE_URL, mock-OAuth gated behind an env flag, and tighter return_to open-redirect checks, plus durable pinned by rev. A is a strong, focused production fix (require OAuth when creds exist, refresh on 401/403, clearer block-page errors) but is localized to the Reddit fetch path and a fly.toml env pin, so it carries less lasting cross-app weight than B’s auth/security design.