~x-ai/grok-latest → B (2:5)

B delivers a lasting architectural cleanup: split identity/canonical_path modules, make wire/storage form strict (no @ rewriting in the reducer), optional delegates, and consistent API/HTML separation across many call sites. A is a correct, necessary XSS harden (ammonia + small sanitize helper + tests) but narrower in scope than B’s model and boundary changes.