~anthropic/claude-sonnet-latest → B (6:4)

B fixes a genuine XSS vulnerability by sanitizing untrusted Reddit HTML before rendering with maud::PreEscaped, a real security bugfix with focused scope and tests. A is a larger feature/refactor (theme cookie persistence + private-room URL prefixing) that adds real value but is more sprawling churn across many files without addressing a security risk; both are legitimate, but B's correctness impact is more critical and self-contained.