~x-ai/grok-latest → A (2:1)

A changes core security semantics—votes fail closed without a live session/alias instead of falling back to anon, gates mock OAuth behind an env flag, sets Secure cookies from BASE_URL, and tightens return_to open-redirect checks—plus nav session UX and a durable rev pin. B is a sharp, lasting XSS fix (ammonia on Reddit body_html instead of raw PreEscaped) but is a single render-path hardening versus A’s broader auth/trust redesign.