openai/gpt-chat-latest → A (5:2)

Side A introduces a lasting architectural separation by extracting `canonical_path.rs` and `identity.rs`, removing identity rewriting from the reducer, standardizing stored/wire identities without `@`, making delegates optional, and updating APIs and tests to enforce validated stored-form identities. Side B contains worthwhile security hardening—failing closed on unauthenticated voting, gating mock OAuth, adding Secure cookie handling, and tightening redirect validation—but its scope is narrower than A's broad cleanup of identity handling and normalization invariants across the project.