~anthropic/claude-sonnet-latest → B (45:55)

Side B fixes concrete security bugs: fail-closed vote resolution (previously any missing/expired session silently fell back to anonymous voting), gating mock OAuth behind an env flag, adding Secure cookie flags over HTTPS, closing an open-redirect vector in return_to sanitization, and pinning the `durable` git dependency to a rev instead of a floating branch. Side A is a large, mostly mechanical reorg (splitting canonical_path/identity modules, dropping `@` from wire form) that improves clarity but is lower-stakes churn compared to B's genuine auth-hardening fixes.